GHSA-8hgg-xxm5-3873

GitHub Security Advisory

DOMPurify Open Redirect vulnerability

✓ GitHub Reviewed MODERATE Has CVE

DOMPurify before 1.0.11 allows reverse tabnabbing in demos/hooks-target-blank-demo.html because links lack a 'rel="noopener noreferrer"' attribute.

npm dompurify

Affected versions: 0 (fixed in 1.0.11)

CVE-2019-25155

GHSA ID

GHSA-8hgg-xxm5-3873

Published

November 14, 2023 9:30 PM

Last Modified

November 15, 2023 8:11 PM

CVSS Score

5.0 /10

Primary Ecosystem

npm

Primary Package

dompurify

GitHub Reviewed

✓ Yes

Last updated: July 3, 2025 6:26 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.