dompurify 3.2.2

Direct Vulnerabilities

Known vulnerabilities in the dompurify package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Operator Precedence Logic Error dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Operator Precedence Logic Error in the form of short-circuit evaluation that gives precedence to `ADD_TAGS` over `FORBID_TAGS` in `_sanitizeElements()`. In an application where `ADD_TAGS` is used as a function (via `EXTRA_ELEMENT_HANDLING.tagCheck`) and `FORBID_TAGS` is in use, an attacker can cause forbidden tags to be allowed. How to fix Operator Precedence Logic Error? Upgrade `dompurify` to version 3.4.0 or higher.	<3.4.0
M Permissive List of Allowed Inputs dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Permissive List of Allowed Inputs in the `ADD_ATTR` predicate function via `EXTRA_ELEMENT_HANDLING.attributeCheck`. An attacker can inject and execute malicious scripts in the DOM by bypassing URI validation for specific attribute and tag combinations, such as allowing `href` attributes with unsafe protocols like `javascript:`. How to fix Permissive List of Allowed Inputs? Upgrade `dompurify` to version 3.3.2 or higher.	<3.3.2
M Prototype Pollution dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Prototype Pollution in the `USE_PROFILES` function. An attacker can execute arbitrary JavaScript code in the context of the user’s browser by polluting `Array.prototype` with event handler attributes, causing the sanitizer to incorrectly allow dangerous attributes such as `onclick`. How to fix Prototype Pollution? Upgrade `dompurify` to version 3.3.2 or higher.	<3.3.2
M Cross-site Scripting (XSS) dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Cross-site Scripting (XSS) when sanitized HTML is reinserted into a new parsing context using `innerHTML` and special wrappers such as `script`, `xmp`, `iframe`, `noembed`, `noframes`, or `noscript`. An attacker can execute arbitrary JavaScript code in the client by crafting input that closes the special parsing context early and injects malicious markup, which is then interpreted during the second parse. How to fix Cross-site Scripting (XSS)? Upgrade `dompurify` to version 3.3.2 or higher.	<3.3.2
M Cross-site Scripting (XSS) dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the `createDOMPurify()` function, via comments embedded in XML `textarea` attributes containing scripts. How to fix Cross-site Scripting (XSS)? Upgrade `dompurify` to version 3.2.7 or higher.	<3.2.7
M Cross-site Scripting (XSS) dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the `createDOMPurify()` function, via comments embedded in XML `noscript`, `xmp`, `noembed`, `noframes`, and `iframe` attributes containing scripts. How to fix Cross-site Scripting (XSS)? Upgrade `dompurify` to version 2.5.9, 3.3.2 or higher.	<2.5.9>=3.0.0 <3.3.2
L Cross-site Scripting (XSS) dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to incorrect handling of template literals in regular expressions. An attacker can manipulate the output of the script by injecting malicious payloads that bypass the `dompurify` sanitization. How to fix Cross-site Scripting (XSS)? Upgrade `dompurify` to version 3.2.4 or higher.	<3.2.4

Vulnerability

Vulnerable Version

Operator Precedence Logic Error