Cure53 DOMPurify

DOMPurify nesting-based mXSS

DOMPurify vulnerable to tampering by prototype polution

DOMPurify XSS via `selectedcontent` re-clone

Tampering by prototype polution in DOMPurify

DOMPurify before 3.4.11 Permanent Attribute Allowlist Pollution via setConfig

DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content

Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as demonstrated by nesting of FORM elements.

DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demonstrated by Chrome and Safari.

DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS).

DOMPurify before 1.0.11 allows reverse tabnabbing in demos/hooks-target-blank-demo.html because links lack a 'rel="noopener noreferrer"' attribute.

DOMPurify before 3.4.9 Trusted Types Policy State Contamination

DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)

DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks

DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM

DOMPurify before 3.4.7 Hook Mutation Pollution via allowedTags

DOMPurify XSS via Missing Rawtext Elements in SAFE_FOR_XML

DOMPurify before 3.4.0 XSS via ADD_ATTR/ADD_TAGS State Leakage

DOMPurify before 3.4.0 ADD_TAGS Function Bypasses FORBID_TAGS

DOMPurify before 3.3.2 Prototype Pollution via USE_PROFILES

DOMPurify before 3.4.8 Template Expression Injection via RETURN_DOM

DOMPurify before 3.3.2 Mutation XSS via Re-Contextualization

DOMPurify before 3.4.12 Hook Bypass via CUSTOM_ELEMENT_HANDLING

DOMPurify before 3.3.2 URI Validation Bypass via ADD_ATTR

DOMPurify 3.4.6 Cross-Site Scripting via IN_PLACE nodeName

DOMPurify XSS via Textarea Rawtext Bypass in SAFE_FOR_XML

DOMPurify through 3.3.3 Cross-Site Scripting via IN_PLACE mode