Cross-Site Scripting Vulnerability in DOMPurify by Cure53
CVE-2025-15599
5.1MEDIUM
What is CVE-2025-15599?
DOMPurify versions ranging from 2.5.3 to 2.5.8 and from 3.1.3 to 3.2.6 are susceptible to a cross-site scripting vulnerability. This issue arises from inadequate validation of the rawtext element within textarea attributes, specifically within the SAFE_FOR_XML regex. Attackers can exploit this flaw by inserting closing rawtext tags, such as , into attribute values, enabling them to escape the rawtext context and execute arbitrary JavaScript when the sanitized output is rendered within rawtext elements. The vulnerability in the 3.x branch has been addressed in version 3.2.7, whereas the 2.x branch remains unpatched.
Affected Version(s)
DOMPurify 3.1.3 <= 3.2.6
DOMPurify 2.5.3 <= 2.5.8
DOMPurify 3.2.7