DOMPurify Open Redirect vulnerability

MEDIUM 6.1CVE-2019-25155 · GHSA-8hgg-xxm5-3873 · Published 07/11/2023 · updated 17/06/2026

In short

CVE-2019-25155 is a MEDIUM (CVSS 6.1) vulnerability affecting dompurify (cure53), dompurify.
Chance of exploitation in the next 30 days (EPSS): 0.58%, higher than 47.5% of all vulnerabilities.
Fix: update to 1.0.11 or later.

Package	Affected versions	Patched versions
dompurify cure53	`< 1.0.11`	`1.0.11`
dompurify npm	`< 1.0.11`	`1.0.11`

DOMPurify before 1.0.11 allows reverse tabnabbing in demos/hooks-target-blank-demo.html because links lack a 'rel="noopener noreferrer"' attribute.

NVD description

DOMPurify before 1.0.11 allows reverse tabnabbing in demos/hooks-target-blank-demo.html because links lack a 'rel="noopener noreferrer"' attribute.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

< 1.0.11

1.0.11

npm

< 1.0.11

1.0.11

Description

DOMPurify before 1.0.11 allows reverse tabnabbing in demos/hooks-target-blank-demo.html because links lack a 'rel="noopener noreferrer"' attribute.

NVD description

DOMPurify before 1.0.11 allows reverse tabnabbing in demos/hooks-target-blank-demo.html because links lack a 'rel="noopener noreferrer"' attribute.

More vulnerabilities in dompurify

See all →