GHSA-h6p3-p4vx-wr8q
dompurify vulnerable to Cross-site Scripting
No scoreFix available
dompurify prior to version 2.2.3 is vulnerable to a cross-site scripting problem caused by nested headlines.
What each source reports
GitHub AdvisoriesNo score
dompurify vulnerable to Cross-site Scripting
dompurify prior to version 2.2.3 is vulnerable to a cross-site scripting problem caused by nested headlines.
- Record
GHSA-h6p3-p4vx-wr8q- Updated
- 2026-11-02
OSVNo score
dompurify vulnerable to Cross-site Scripting
dompurify prior to version 2.2.3 is vulnerable to a cross-site scripting problem caused by nested headlines.
- Record
GHSA-h6p3-p4vx-wr8q- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dompurifyPyPI | before 2.2.3 | 2.2.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-h6p3-p4vx-wr8q is a vulnerability with no CVSS score yet in dompurify, published January 11, 2023. No source lists public exploit code. Fixed in dompurify 2.2.3.