{"id":"CVE-2019-16728","aliases":["DLA-2419-1","EUVD-2020-0615","GHSA-chqj-j4fh-rw7m","UBUNTU-CVE-2019-16728"],"status":"published","title":"Cross-Site Scripting in dompurify","description":"DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demonstrated by Chrome and Safari.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01459,"percentile":0.73738,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2019-09-24T04:02:09Z","modified":"2026-10-24T10:30:57Z","fixes":[{"ecosystem":"npm","package":"dompurify","fixed_in":["2.0.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"dompurify.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.2~dfsg1-1+deb9u1"}]}],"versions":["0.8.2~dfsg1-1"],"bundled":2},{"source":"osv","ecosystem":"npm","package":"dompurify","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.0.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"dompurify.js","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.0~dfsg1-1","0.9.0~dfsg1-2"]}],"products":[{"vendor":"cure53","product":"dompurify"},{"vendor":"debian","product":"debian_linux"}],"references":[{"url":"https://research.securitum.com/dompurify-bypass-using-mxss/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/10/msg00029.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16728","tags":["advisory"]},{"url":"https://www.npmjs.com/advisories/1205","tags":["web"]},{"url":"https://github.com/advisories/GHSA-chqj-j4fh-rw7m"},{"url":"https://research.securitum.com/dompurify-bypass-using-mxss","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-16728","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-16728","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-16728","description":"DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demonstrated by Chrome and Safari.","status":"published","published":"2019-09-24T04:02:09Z","modified":"2024-08-05T01:24:47.114Z","updated_at":"2026-11-02T14:32:23.485011Z"}],"euvd":[{"id":"EUVD-2020-0615","description":"DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demonstrated by Chrome and Safari.","status":"published","published":"2019-09-24T04:02:09Z","modified":"2024-08-05T01:24:47Z","updated_at":"2026-11-03T02:40:31.903592Z"}],"ghsa":[{"id":"GHSA-chqj-j4fh-rw7m","title":"Cross-Site Scripting in dompurify","description":"Versions of `dompurify` prior to 2.0.3 are vulnerable to Cross-Site Scripting (XSS). The package has an XSS filter bypass due to Mutation XSS in both Chrome and Safari through a combination of `\u003csvg\u003e`/`\u003cmath\u003e` elements and `\u003c/p\u003e`/`\u003c/br\u003e`. An example payload is: `\u003csvg\u003e\u003c/p\u003e\u003cstyle\u003e\u003ca id=\"\u003c/style\u003e\u003cimg src=1 onerror=alert(1)\u003e\"\u003e`. This allows attackers to bypass the XSS protection and execute arbitrary JavaScript in a victim's browser.\n\n\n## Recommendation\n\nUpgrade to version 2.0.3 or later. You may also disallow `\u003csvg\u003e` and `\u003cmath\u003e` through `dompurify` configurations:\n```DOMPurify.sanitize(input, {\n     FORBID_TAGS: ['svg', 'math']\n });```","status":"published","published":"2020-08-28T21:25:11Z","modified":"2023-09-13T18:51:45Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:05.004935Z"}],"nvd":[{"id":"CVE-2019-16728","description":"DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demonstrated by Chrome and Safari.","status":"published","published":"2019-09-24T05:15:11.127Z","modified":"2026-06-17T02:22:41.013Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:05:28.126831Z"}],"osv":[{"id":"CVE-2019-16728","description":"DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demonstrated by Chrome and Safari.","status":"published","published":"2019-09-24T05:15:11.127Z","modified":"2026-10-24T10:30:57.302877293Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:11.673963Z"},{"id":"GHSA-chqj-j4fh-rw7m","title":"Cross-Site Scripting in dompurify","description":"Versions of `dompurify` prior to 2.0.3 are vulnerable to Cross-Site Scripting (XSS). The package has an XSS filter bypass due to Mutation XSS in both Chrome and Safari through a combination of `\u003csvg\u003e`/`\u003cmath\u003e` elements and `\u003c/p\u003e`/`\u003c/br\u003e`. An example payload is: `\u003csvg\u003e\u003c/p\u003e\u003cstyle\u003e\u003ca id=\"\u003c/style\u003e\u003cimg src=1 onerror=alert(1)\u003e\"\u003e`. This allows attackers to bypass the XSS protection and execute arbitrary JavaScript in a victim's browser.\n\n\n## Recommendation\n\nUpgrade to version 2.0.3 or later. You may also disallow `\u003csvg\u003e` and `\u003cmath\u003e` through `dompurify` configurations:\n```DOMPurify.sanitize(input, {\n     FORBID_TAGS: ['svg', 'math']\n });```","status":"published","published":"2020-08-28T21:25:11Z","modified":"2023-11-08T04:01:20.360896Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:45.28161Z"},{"id":"UBUNTU-CVE-2019-16728","description":"DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demonstrated by Chrome and Safari.","status":"published","published":"2019-09-24T05:15:00Z","modified":"2025-10-24T04:47:53Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:20.325378Z"},{"id":"DLA-2419-1","title":"dompurify.js - security update","status":"published","published":"2020-10-29T00:00:00Z","modified":"2026-03-09T01:21:54.64281Z","updated_at":"2026-11-02T15:46:10.712745Z"}]}}