GHSA-h7mw-gpvr-xq4m
NoneCVSS
—
EPSS
—
Published
Apr 22, 2026
CISA due date
—
The record
DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | dompurify | 0 | 3.4.0 |
Related vulnerabilities
- CVE-2026-41240 DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Same vulnerability
- GHSA-cmwh-pvxp-8882 DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook… Also affects dompurify
- GHSA-vxr8-fq34-vvx9 DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later… Also affects dompurify
- GHSA-gvmj-g25r-r7wr DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside… Also affects dompurify
- GHSA-rp9w-3fw7-7cwq DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside .content Also affects dompurify
- GHSA-x4vx-rjvf-j5p4 DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes… Also affects dompurify
- GHSA-76mc-f452-cxcm DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently… Also affects dompurify
- GHSA-hpcv-96wg-7vj8 DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via… Also affects dompurify