An open index of dependabot pull requests across open source projects.

dompurify

Ecosystem:
npm
Package URL:
pkg:npm/dompurify
Total PRs:
5,301 Dependabot PRs
Latest PR:
about 5 hours ago
Unique Repositories:
3,229 repositories
Unique Repos (30 days):
406 repositories
Security Advisories
DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback
GHSA-v9jr-rg53-9pgp CVE-2026-41238 MODERATE published about 1 month ago • updated 4 days ago
## Summary DOMPurify versions 3.0.1 through 3.3.3 (latest) are vulnerable to a prototype pollution-based XSS bypass. When an application uses `DOM...
DOMPurify allows Cross-site Scripting (XSS)
GHSA-vhxf-7vqr-mrjg CVE-2025-26791 MODERATE published over 1 year ago • updated 4 days ago
DOMPurify before 3.2.4 has an incorrect template literal regular expression when SAFE_FOR_TEMPLATES is set to true, sometimes leading to mutation c...
DOMPurify ADD_ATTR predicate skips URI validation
GHSA-cjmm-f4jc-qw8r MODERATE published about 2 months ago • updated 5 days ago
## Summary DOMPurify allows `ADD_ATTR` to be provided as a predicate function via `EXTRA_ELEMENT_HANDLING.attributeCheck`. When the predicate retur...
Cross-Site Scripting in dompurify
GHSA-mjjq-c88q-qhr6 CRITICAL published over 5 years ago • updated 1 day ago
Versions of `dompurify` prior to 2.0.7 are vulnerable to Cross-Site Scripting (XSS). It is possible to bypass the package sanitization through Muta...
DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation
GHSA-39q2-94rc-95cp MODERATE published about 2 months ago • updated 5 days ago
## Summary In `src/purify.ts:1117-1123`, `ADD_TAGS` as a function (via `EXTRA_ELEMENT_HANDLING.tagCheck`) bypasses `FORBID_TAGS` due to short-circu...
Recent PRs
Package Details
Name: dompurify
Ecosystem: npm
PURL Type: npm
Package URL: pkg:npm/dompurify
JSON API: View JSON
Security Advisories

17

Active advisories
CRITICAL 2
HIGH 2
MODERATE 13
View All npm Advisories
Package Information
Description:

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin

Repository: https://github.com/cure53/DOMPurify
Homepage: https://github.com/cure53/DOMPurify
Latest Release: 3.2.6
about 1 year ago
Dependent Repos: 56,633
Dependent Packages: 1,705
Downloads: 43,072,032
Ranking: Top 0.1284% by dependent repos Top 0.0589% by downloads Top 0.0449% by dependent pkgs
PR Status
Open 2,724 (51.4%)
Merged 269 (5.1%)
Closed 2,059 (38.9%)
PR Types
Major 498 (9.4%)
Minor 2,307 (43.5%)
Patch 2,209 (41.7%)
Removal 1 (0.0%)