MediumFix available
node-dompurify — security advisory
DOMPurify 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting missing textarea rawtext element validation in the SAFE_FOR_XML regex. Attackers can include closing rawtext tags like in attribute values to break out of rawtext contexts and execute JavaScript when sanitized output is placed inside rawtext elements. The 3.x branch was fixed in 3.2.7; the 2.x branch was never patched.
- Products
- node-dompurify
- Affected versions
- 2.4.1+dfsg+~2.4.0-1, 2.4.1+dfsg+~2.4.0-2, 2.4.1+dfsg+~2.4.0-2+deb12u1, 3.0.9+dfsg+~3.0.5-1, 3.1.6+dfsg+~3.0.5-1, 3.1.7+dfsg+~3.0.5-1, 3.1.7+dfsg+~3.0.5-2, 3.2.5+dfsg-1, 3.3.2+dfsg-1, 3.3.3+dfsg-1, 3.3.3+dfsg-2, 3.4.1+dfsg-1, 3.4.12+dfsg-1, 3.4.13+dfsg-1, 3.4.13+dfsg-2, 3.4.16+dfsg-1, 3.4.2+dfsg-1, 3.4.5+dfsg-1
- Fixed versions
- 3.3.2+dfsg-1
- CVEs
- CVE-2025-15599
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 28 Oct 2026, 11:09 UTC · Revision 1
Source evidence
DOMPurify 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting missing textarea rawtext element validation in the SAFE_FOR_XML regex. Attackers can include closing rawtext tags like in attribute values to break out of rawtext contexts and execute JavaScript when sanitized output is placed inside rawtext elements. The 3.x branch was fixed in 3.2.7; the 2.x branch was never patched.
osv:DEBIAN-CVE-2025-15599
node-dompurify
Fixed versions: Not specified
node-dompurify
Fixed versions: Not specified
node-dompurify
Fixed versions: 3.3.2+dfsg-1
Complete source record
{
"id": "16fba1722849a17dcc329742ca4f179feaac284e3ff6e03332204e11fa09ccfe",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2025-15599",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2025-15599",
"summary": "DOMPurify 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting missing textarea rawtext element validation in the SAFE_FOR_XML regex. Attackers can include closing rawtext tags like in attribute values to break out of rawtext contexts and execute JavaScript when sanitized output is placed inside rawtext elements. The 3.x branch was fixed in 3.2.7; the 2.x branch was never patched.",
"evidence": "osv:DEBIAN-CVE-2025-15599",
"products": [
{
"name": {
"value": "node-dompurify",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.4.1+dfsg+~2.4.0-1",
"evidence": "/affected/0/versions"
},
{
"value": "2.4.1+dfsg+~2.4.0-2",
"evidence": "/affected/0/versions"
},
{
"value": "2.4.1+dfsg+~2.4.0-2+deb12u1",
"evidence": "/affected/0/versions"
},
{
"value": "3.0.9+dfsg+~3.0.5-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.1.6+dfsg+~3.0.5-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.1.7+dfsg+~3.0.5-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.1.7+dfsg+~3.0.5-2",
"evidence": "/affected/0/versions"
},
{
"value": "3.2.5+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.3.2+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.3.3+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.3.3+dfsg-2",
"evidence": "/affected/0/versions"
},
{
"value": "3.4.1+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.4.12+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.4.13+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.4.13+dfsg-2",
"evidence": "/affected/0/versions"
},
{
"value": "3.4.16+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.4.2+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "3.4.5+dfsg-1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "node-dompurify",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.1.7+dfsg+~3.0.5-2",
"evidence": "/affected/1/versions"
},
{
"value": "3.2.5+dfsg-1",
"evidence": "/affected/1/versions"
},
{
"value": "3.3.2+dfsg-1",
"evidence": "/affected/1/versions"
},
{
"value": "3.3.3+dfsg-1",
"evidence": "/affected/1/versions"
},
{
"value": "3.3.3+dfsg-2",
"evidence": "/affected/1/versions"
},
{
"value": "3.4.1+dfsg-1",
"evidence": "/affected/1/versions"
},
{
"value": "3.4.12+dfsg-1",
"evidence": "/affected/1/versions"
},
{
"value": "3.4.13+dfsg-1",
"evidence": "/affected/1/versions"
},
{
"value": "3.4.13+dfsg-2",
"evidence": "/affected/1/versions"
},
{
"value": "3.4.16+dfsg-1",
"evidence": "/affected/1/versions"
},
{
"value": "3.4.2+dfsg-1",
"evidence": "/affected/1/versions"
},
{
"value": "3.4.5+dfsg-1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "node-dompurify",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.3.2+dfsg-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": [
{
"value": "3.1.7+dfsg+~3.0.5-2",
"evidence": "/affected/2/versions"
},
{
"value": "3.2.5+dfsg-1",
"evidence": "/affected/2/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "DEBIAN-CVE-2025-15599",
"aliases": [
"DEBIAN-CVE-2025-15599"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "node-dompurify",
"purl": "pkg:deb/debian/node-dompurify?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"2.4.1+dfsg+~2.4.0-1",
"2.4.1+dfsg+~2.4.0-2",
"2.4.1+dfsg+~2.4.0-2+deb12u1",
"3.0.9+dfsg+~3.0.5-1",
"3.1.6+dfsg+~3.0.5-1",
"3.1.7+dfsg+~3.0.5-1",
"3.1.7+dfsg+~3.0.5-2",
"3.2.5+dfsg-1",
"3.3.2+dfsg-1",
"3.3.3+dfsg-1",
"3.3.3+dfsg-2",
"3.4.1+dfsg-1",
"3.4.12+dfsg-1",
"3.4.13+dfsg-1",
"3.4.13+dfsg-2",
"3.4.16+dfsg-1",
"3.4.2+dfsg-1",
"3.4.5+dfsg-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-15599.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "node-dompurify",
"purl": "pkg:deb/debian/node-dompurify?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"3.1.7+dfsg+~3.0.5-2",
"3.2.5+dfsg-1",
"3.3.2+dfsg-1",
"3.3.3+dfsg-1",
"3.3.3+dfsg-2",
"3.4.1+dfsg-1",
"3.4.12+dfsg-1",
"3.4.13+dfsg-1",
"3.4.13+dfsg-2",
"3.4.16+dfsg-1",
"3.4.2+dfsg-1",
"3.4.5+dfsg-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-15599.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.3.2+dfsg-1"
}
]
}
],
"package": {
"name": "node-dompurify",
"purl": "pkg:deb/debian/node-dompurify?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"3.1.7+dfsg+~3.0.5-2",
"3.2.5+dfsg-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-15599.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-09T10:00:45.954364219Z",
"provider": "osv",
"upstream": [
"CVE-2025-15599"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2025-15599"
]
},
"related_cves": [
{
"value": "CVE-2025-15599",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 111736,
"published_at": "2026-03-03T18:16:23.06+00:00"
}