CVE-2025-15599
Fixed in a distro release EPSS <1%CVSS 6.1
DOMPurify 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting missing textarea rawtext element validation in the SAFE_FOR_XML regex. Attackers can include closing rawtext tags like </textarea> in attribute values to break out of rawtext contexts and execute JavaScript when sanitized output is placed inside rawtext elements. The 3.x branch was fixed in 3.2.7; the 2.x branch was never patched.
Products: cure53 dompurify
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | dompurify | 3.2.7 |
Affected upstream, no fix yet
| Ecosystem | Package |
|---|---|
| npm | dompurify |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | gitlab-rails-ce-18.1 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.1 | no fix |
| Chainguard | langfuse-2 | 2.95.12-r13 |
| Chainguard | langfuse-2-worker | 2.95.12-r13 |
| Chainguard | langfuse-3 | 3.160.0-r1 |
| Chainguard | langfuse-3-worker | 3.160.0-r1 |
| Chainguard | langfuse-fips-2 | 2.95.12-r16 |
| Chainguard | langfuse-fips-2-worker | 2.95.12-r16 |
| Chainguard | langfuse-fips-3 | 3.160.0-r1 |
| Chainguard | langfuse-fips-3-worker | 3.160.0-r1 |
| Chainguard | opensearch-dashboards-2 | 2.19.5-r3 |
| Chainguard | opensearch-dashboards-2-fips | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-3 | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-fips | 3.5.0-r6 |
| Chainguard | wazuh-dashboard-plugins | 4.14.4-r1 |
| Debian 12 | node-dompurify | no fix |
| Debian 13 | node-dompurify | no fix |
| Debian 14 | node-dompurify | 3.3.2+dfsg-1 |
| Ubuntu 22.04 LTS | node-dompurify | no fix |
| Ubuntu 24.04 LTS | node-dompurify | no fix |
| Ubuntu 25.10 | node-dompurify | no fix |
| Ubuntu 26.04 LTS | node-dompurify | no fix |
| Ubuntu 26.10 | node-dompurify | no fix |
| Wolfi | langfuse-3 | 3.160.0-r1 |
| Wolfi | langfuse-3-worker | 3.160.0-r1 |
| Wolfi | opensearch-dashboards-3 | 3.5.0-r6 |