Protection Mechanism Failure Affecting dompurify package, versions <3.4.9
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-DOMPURIFY-17344552
- published16 Jun 2026
- disclosed15 Jun 2026
- creditoffset
Introduced: 15 Jun 2026
New CVE NOT AVAILABLE CWE-693 (opens in a new tab)How to fix?
Upgrade dompurify to version 3.4.9 or higher.
Overview
dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.
Affected versions of this package are vulnerable to Protection Mechanism Failure through the clearConfig function. An attacker can execute arbitrary scripts in a Trusted Types sink by influencing a previously supplied TRUSTED_TYPES_POLICY on a reused instance and later triggering output with RETURN_TRUSTED_TYPE: true.
Note:
This is only exploitable if a DOMPurify instance is reused across trust boundaries and a less-trusted integration or attacker has previously set an unsafe Trusted Types policy.