Dompurify
Vendor:
First CVE: Sep 24, 2019 · Active for 6 years
27
Total CVEs
More Total CVEs than 96% of tracked products
4.5
Avg CVEs / Year
Higher CVE frequency than 86% of tracked products
6.3
Avg CVSS
Higher Avg CVSS than 26% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Dompurify over time
Volume of CVEsAvg CVSS Base Score
First CVE
Sep 24, 2019
6 years ago
Most Recent CVE
Jul 24, 2026
1 day ago
CVE Severity & Scoring
Dompurify27 CVEs
85%
11%
All CVEs352,708 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network27 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low25 (92.6%)
High2 (7.4%)
Unknown0 (0.0%)
User Interaction
None3 (11.1%)
Unknown0 (0.0%)
Required23 (85.2%)
Privileges Required
Low0 (0.0%)
High0 (0.0%)
None27 (100.0%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (27 CVEs).
27 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-47423HIGH DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. In 3.4.4, DOMPurify allowed selectedcontent by default, allowing browsers to re-clone an XSS paylo | Jul 14, 2026 | 8.2 | 34 | NO | NO |
CVE-2026-49978MEDIUM DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.7, DOMPurify IN_PLACE sanitization could skip shadow contents attached to an element | Jul 14, 2026 | 6.1 | 30 | NO | NO |
CVE-2026-65898HIGH DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared al | Jul 23, 2026 | 7.2 | 29 | NO | NO |
CVE-2026-49459MEDIUM DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve event-handler attribut | Jul 14, 2026 | 6.1 | 29 | NO | NO |
CVE-2024-48910CRITICAL DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability is fixed in 2.4.2. | Oct 31, 2024 | 9.8 | 29 | NO | NO |
CVE-2026-66010MEDIUM DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOM_ELEMENT_HANDLING.tagNameCheck, allowing attributes to bypass application | Jul 24, 2026 | 6.1 | 28 | NO | NO |
CVE-2026-49458MEDIUM DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(node, { IN_PLACE: true }) accepted same-origin foreign-realm DO | Jul 14, 2026 | 6.1 | 28 | NO | NO |
CVE-2026-65913MEDIUM DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties | Jul 23, 2026 | 6.1 | 26 | NO | NO |
CVE-2026-65912MEDIUM DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck. Attackers can sup | Jul 23, 2026 | 6.1 | 26 | NO | NO |
CVE-2026-65911MEDIUM In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) across subsequent sanit | Jul 23, 2026 | 6.1 | 26 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (27 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (27 CVEs).
Media Mentions
Signals from CVEs in this product scope (27 CVEs).
Top CNAs Publishing CVEs For Dompurify
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 3.4.4 | 1 | 8.2 | 0.3% | 0 | 0 |