CVE-2025-15599: DOMPurify XSS via Textarea Rawtext Bypass in SAFE_FOR_XML
DOMPurify 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting missing textarea rawtext element validation in the SAFE_FOR_XML regex. Attackers can include closing rawtext tags like </textarea> in attribute values to break out of rawtext contexts and execute JavaScript when sanitized output is placed inside rawtext elements. The 3.x branch was fixed in 3.2.7; the 2.x branch was never patched.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-15599?
The severity of CVE-2025-15599 is considered high due to its potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2025-15599?
To fix CVE-2025-15599, upgrade DOMPurify to versions 3.2.7 or higher, or 2.5.9 or higher.
What versions of DOMPurify are affected by CVE-2025-15599?
CVE-2025-15599 affects DOMPurify versions 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8.
What type of vulnerability is CVE-2025-15599?
CVE-2025-15599 is a cross-site scripting (XSS) vulnerability that allows attackers to bypass attribute sanitization.
What causes CVE-2025-15599?
CVE-2025-15599 is caused by missing validation of textarea rawtext elements in the SAFE_FOR_XML regex.