DOMPurify: XSS sanitizer for HTML, MathML, SVG
DOM-based XSS sanitizer using native browser parsing.
Learn more about DOMPurify
DOMPurify is a JavaScript library that sanitizes HTML, MathML, and SVG content to mitigate XSS vulnerabilities. It operates by parsing input strings through the browser's DOM implementation, leveraging native parsing and serialization mechanisms rather than regex-based approaches. The library supports modern browsers including Chrome, Firefox, Safari, and Edge, and can run server-side using Node.js with jsdom. Common use cases include sanitizing user-generated content, processing rich text input, and protecting against injection attacks in web applications.
Browser-Native DOM Parsing
Delegates HTML parsing to the browser's native DOM implementation instead of regex or string manipulation. Leverages the same security-tested parser used by the browser itself, avoiding common pitfalls of custom parsing logic.
Multi-Format Sanitization Support
Handles HTML, MathML, and SVG content through configurable profiles. Restricts sanitization scope per format via USE_PROFILES option, enabling targeted protection for specific markup types.
Configurable Hooks System
Provides hooks for customizing sanitization behavior at key processing stages. Developers can modify, inspect, or reject elements and attributes programmatically, enabling domain-specific security policies beyond default rules.
import DOMPurify from 'dompurify';
const userInput = '<img src=x onerror=alert(1)>Hello <b>World</b>';
const cleanHTML = DOMPurify.sanitize(userInput);
document.getElementById('content').innerHTML = cleanHTML;
// Output: Hello <b>World</b> (XSS removed)Maintenance release adds SVG mask-type attribute, function support for ADD_ATTR/ADD_TAGS, and fixes slot element duplication.
- –Pass functions to ADD_ATTR and ADD_TAGS config options for dynamic allow-list control at sanitization time.
- –SVG mask-type attribute now allowed by default; slot element duplication between SVG and HTML lists resolved.
Security-focused patch improving CDATA handling and animated href checks; expands default allow-list and refines custom element hooks.
- –Review CDATA and textarea sanitization logic if you process user-supplied XML or raw-text elements.
- –Leverage new `tagName` parameter in `attributeNameCheck` hooks for custom element validation if needed.
Hardens config against prototype pollution and removes script triggering false CVE-2025-48050; no breaking changes noted.
- –Update to eliminate false-positive CVE-2025-48050 alert caused by removed script.
- –Review custom configs for prototype pollution risks now mitigated by hardened validation.
See how people are using DOMPurify
Top in Security
Related Repositories
Discover similar tools and frameworks used by developers
subfinder
Passive subdomain discovery via DNS resolution and validation.
fail2ban
Log-based intrusion prevention via dynamic firewall management.
openssl
C-based cryptographic library implementing TLS, DTLS, and QUIC protocols.
OSINT-Framework
Structured web catalog of free OSINT tools.
CyberChef
Browser-based data transformation tool with chainable operations.