Medium severity6.1NVD Advisory· Published Mar 3, 2026· Updated Jun 17, 2026
CVE-2025-15599
CVE-2025-15599
Description
DOMPurify 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting missing textarea rawtext element validation in the SAFE_FOR_XML regex. Attackers can include closing rawtext tags like in attribute values to break out of rawtext contexts and execute JavaScript when sanitized output is placed inside rawtext elements. The 3.x branch was fixed in 3.2.7; the 2.x branch was never patched.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
dompurifynpm | >= 3.1.3, < 3.2.7 | 3.2.7 |
dompurifynpm | >= 2.5.3, <= 2.5.8 | — |
Affected products
20- osv-coords18 versionspkg:apk/chainguard/langfuse-2pkg:apk/chainguard/langfuse-2-workerpkg:apk/chainguard/langfuse-3pkg:apk/chainguard/langfuse-3-workerpkg:apk/chainguard/langfuse-fips-2pkg:apk/chainguard/langfuse-fips-2-workerpkg:apk/chainguard/langfuse-fips-3pkg:apk/chainguard/langfuse-fips-3-workerpkg:apk/chainguard/opensearch-dashboards-2pkg:apk/chainguard/opensearch-dashboards-2-fipspkg:apk/chainguard/opensearch-dashboards-3pkg:apk/chainguard/opensearch-dashboards-3-fipspkg:apk/chainguard/wazuh-dashboard-pluginspkg:apk/wolfi/langfuse-3pkg:apk/wolfi/langfuse-3-workerpkg:apk/wolfi/opensearch-dashboards-2pkg:apk/wolfi/opensearch-dashboards-3pkg:npm/dompurify
< 2.95.12-r13+ 17 more
- (no CPE)range: < 2.95.12-r13
- (no CPE)range: < 2.95.12-r13
- (no CPE)range: < 3.160.0-r1
- (no CPE)range: < 3.160.0-r1
- (no CPE)range: < 2.95.12-r16
- (no CPE)range: < 2.95.12-r16
- (no CPE)range: < 3.160.0-r1
- (no CPE)range: < 3.160.0-r1
- (no CPE)range: < 2.19.5-r3
- (no CPE)range: < 2.19.5-r1
- (no CPE)range: < 3.5.0-r6
- (no CPE)range: < 3.5.0-r6
- (no CPE)range: < 4.14.4-r1
- (no CPE)range: < 3.160.0-r1
- (no CPE)range: < 3.160.0-r1
- (no CPE)range: < 2.19.5-r3
- (no CPE)range: < 3.5.0-r6
- (no CPE)range: >= 3.1.3, < 3.2.7
Patches
Vulnerability mechanics
References
5- github.com/cure53/DOMPurify/commit/c861f5a83fb8d90800f1680f855fee551161ac2bnvdPatchWEB
- github.com/advisories/GHSA-v8jm-5vwx-cfxmghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-15599ghsaADVISORY
- www.vulncheck.com/advisories/dompurify-xss-via-textarea-rawtext-bypass-in-safe-for-xmlnvdThird Party AdvisoryWEB
- www.vulncheck.com/advisories/dompurify-xss-via-textarea-rawtext-bypass-in-safeforxmlghsaWEB
News mentions
0No linked articles in our index yet.