DOMPurify Library Bypasses Expose XSS Vulnerabilities

Recent analyses have uncovered multiple bypasses in the DOMPurify library, a widely used HTML sanitizer, which could lead to Cross-Site Scripting (XSS) vulnerabilities. The vulnerabilities stem from parsing and serialization issues within the library, allowing attackers to exploit the sanitization process. Specifically, a mutation XSS vulnerability was identified in DOMPurify versions 2.0.17 and later, affecting web applications relying on this library for sanitizing user-generated content. The vulnerabilities were detailed in multiple articles published on May 22, 2026, highlighting the need for developers to review their implementations. The introduction of the Sanitizer API in Chrome and Firefox aims to mitigate these issues by eliminating the serialization round trip. However, two bypasses for this new API were also reported, indicating ongoing risks. Developers are urged to stay informed about these vulnerabilities and consider adopting the newer Sanitizer API for enhanced security.

Key Points: • Multiple bypasses in DOMPurify expose XSS vulnerabilities in web applications. • DOMPurify versions 2.0.17 and later are particularly affected by these issues. • The new Sanitizer API aims to address these vulnerabilities but has its own bypass risks.