Cross-Site Scripting in dompurify

概要

参考情報

• cure53/DOMPurify · PACKAGE
• cure53/DOMPurify release 2.0.7 · WEB
• npmjs.com/advisories/1223 · WEB

dompurify のその他の脆弱性

• CVE-2026-116804中 6.1DOMPurify from 3.4.4 before 3.4.17 contains a SAFE_FOR_TEMPLATES bypass that lets attackers preserve template expressions in attached shadow…
• CVE-2026-116803中 6.1DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an IN_PLACE ho…
• CVE-2026-116802中 6.1DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when…
• CVE-2026-109345中 6.1DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because IN_PLACE mode ret…
• CVE-2026-109344中 6.1DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because IN_PLACE mode fails to neutralize subtrees detache…