DOMPurify 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting missing textarea rawtext element validation in the SAFE_FOR_XML regex. Attackers can include closing rawtext tags like </textarea> in attribute values to break out of rawtext contexts and execute JavaScript when sanitized output is placed inside rawtext elements. The 3.x branch was fixed in 3.2.7; the 2.x branch was never patched.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - DOMPurify 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 contain a cross-site scripting vulnerability that
    allows attackers to bypass attribute sanitization by exploiting missing textarea rawtext element
    validation in the SAFE_FOR_XML regex. Attackers can include closing rawtext tags like </textarea> in
    attribute values to break out of rawtext contexts and execute JavaScript when sanitized output is placed
    inside rawtext elements. The 3.x branch was fixed in 3.2.7; the 2.x branch was never patched.
    (CVE-2025-15599)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - DOMPurify 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 contain a cross-site scripting vulnerability that     allows attackers to bypass attribute sanitization by exploiting missing textarea rawtext element     validation in the SAFE_FOR_XML regex. Attackers can include closing rawtext tags like </textarea> in     attribute values to break out of rawtext contexts and execute JavaScript when sanitized output is placed     inside rawtext elements. The 3.x branch was fixed in 3.2.7; the 2.x branch was never patched.
    (CVE-2025-15599)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
438385	SCA: security update for dompurify (GHSA-v8jm-5vwx-cfxm)	Tenable Cloud Security	SCA Checks	medium
438385	SCA: security update for dompurify (GHSA-v8jm-5vwx-cfxm)	Tenable Self-Hosted Container Security	SCA Checks	medium
300626	Linux Distros Unpatched Vulnerability : CVE-2025-15599	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-15599

medium

Tenable Plugins

medium

medium

medium