REDHAT-BUG-2461147: Medium severity npm/dompurify vulnerability
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions prior to 3.4.0 have an inconsistency between FORBIDTAGS and FORBIDATTR handling when function-based ADDTAGS is used. Commit c361baa added an early exit for FORBIDATTR at line 1214. The same fix was not applied to FORBIDTAGS. At line 1118-1123, when EXTRAELEMENTHANDLING.tagCheck returns true, the short-circuit evaluation skips the FORBIDTAGS check entirely. This allows forbidden elements to survive sanitization with their attributes intact. Version 3.4.0 patches the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DOMPurifyto a version that resolves this vulnerability.Fixed in 3.4.0
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2461147?
The severity of REDHAT-BUG-2461147 is classified as medium (4).
How do I fix REDHAT-BUG-2461147?
To fix REDHAT-BUG-2461147, upgrade DOMPurify to version 3.4.0 or later.
What does REDHAT-BUG-2461147 affect?
REDHAT-BUG-2461147 affects versions of DOMPurify prior to 3.4.0.
What is the nature of the vulnerability in REDHAT-BUG-2461147?
The vulnerability in REDHAT-BUG-2461147 involves an inconsistency between FORBID_TAGS and FORBID_ATTR handling when using function-based ADD_TAGS.
When was REDHAT-BUG-2461147 published?
REDHAT-BUG-2461147 was published on April 23, 2026.