Executive brief
DOMPurify is a JavaScript library used to sanitize HTML and prevent malicious code injection in web applications. A vulnerability allows attackers to bypass the library's attribute sanitization by crafting special closing tags within attribute values, enabling them to execute arbitrary JavaScript when the sanitized HTML is placed inside textarea elements.
Technical details
DOMPurify versions 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 contain a cross-site scripting vulnerability caused by missing textarea rawtext element validation in the SAFE_FOR_XML regex. Attackers can bypass attribute sanitization by injecting closing rawtext tags (such as `</textarea>`) within attribute values to break out of rawtext contexts and execute JavaScript. The vulnerability requires user interaction to render the malicious HTML in a rawtext element context. The 3.x branch was patched in version 3.2.7; the 2.x branch remains unpatched.
Affected products
- DOMPurify DOMPurify 3.1.3 through 3.2.6, 2.5.3 through 2.5.8
Timeline
- 2026-03-03: disclosed
- 2026-03-04: patched: DOMPurify 3.2.7 released; 2.x branch unpatched