Description
Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as demonstrated by nesting of FORM elements.
Recommendation
Update the dompurify package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.0.17
- Patched version(s): 2.0.17
References
- GHSA-63q7-h895-m982
- lists.debian.org
- research.securitum.com
- snyk.io
- portal.msrc.microsoft.com
- www.oracle.com
- CVE-2020-26870
- CWE-79
- CAPEC-310
- OWASP 2021-A3
- OWASP 2021-A6
Related Issues
- DOMPurify vulnerable to tampering by prototype polution - CVE-2024-48910
- DOMPurify allows Cross-site Scripting (XSS) - CVE-2025-26791
- Valid ECDSA signatures erroneously rejected in Elliptic - CVE-2024-48948
- Trix vulnerable to Cross-site Scripting on copy & paste - CVE-2025-46812
- Tags:
- npm
- dompurify
Anything's wrong? Let us know Last updated on February 01, 2023