dompurify

Security advisories23

• dompurify: DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluationfixed in 3.4.0
• dompurify: DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSSfixed in 3.4.13
• dompurify: DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executesfixed in 3.4.16
• dompurify: DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`fixed in 3.4.7
• dompurify: DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.fixed in 3.4.12
• dompurify: DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xmlfixed in 3.4.17
• dompurify: DOMPurify USE_PROFILES prototype pollution allows event handlersfixed in 3.3.2
• dompurify: DOMPurify ADD_ATTR predicate skips URI validationfixed in 3.3.2
• dompurify: DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)fixed in 3.4.11
• dompurify: DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM modefixed in 3.4.0
• dompurify: DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modesfixed in 3.4.8
• dompurify: DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)fixed in 3.4.0
• dompurify: DOMPurify is vulnerable to mutation-XSS via Re-Contextualization fixed in 3.3.2
• dompurify: DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checksfixed in 3.4.6
• dompurify: DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)fixed in 3.4.17
• dompurify: DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOMfixed in 3.4.6
• dompurify: DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.contentfixed in 3.4.7
• dompurify: DOMPurify contains a Cross-site Scripting vulnerabilityfixed in 3.3.2, 2.5.9
• dompurify: DOMPurify contains a Cross-site Scripting vulnerabilityfixed in 3.2.7
• dompurify: DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallbackfixed in 3.4.0
• dompurify: DOMPurify allows Cross-site Scripting (XSS)fixed in 3.2.4
• dompurify: DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` outputfixed in 3.4.9
• dompurify: DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objectsno fix yet

Versions that change something