[GHSA-v2wj-7wpq-c8vv] DOMPurify contains a Cross-site Scripting vulnerability

[caverav]

Updates

• CVSS v3
• References

Comments
Remove broken advisory link, I also would like credit as I found this vulnerability

[Copilot]

Pull request overview

Updates the DOMPurify XSS advisory metadata, mainly around scoring and references.

Changes:

• Removes the CVSS v3 severity entry, leaving only CVSS v4
• Removes a broken/duplicate reference URL
• Updates the modified timestamp

Comments suppressed due to low confidence (2)

advisories/github-reviewed/2026/03/GHSA-v2wj-7wpq-c8vv/GHSA-v2wj-7wpq-c8vv.json:16

• The PR description says it updates 'CVSS v3', but the diff removes the CVSS_V3 entry entirely (leaving only CVSS_V4). Either update the PR description to reflect that CVSS v3 is being removed, or restore/update the CVSS v3 score as intended. Also, the description mentions adding finder credit, but no credit-related field is added/updated in this change.

  "summary": "DOMPurify contains a Cross-site Scripting vulnerability",
  "details": "DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in 2.5.9 and 3.3.2, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the `SAFE_FOR_XML` regex. Attackers can include payloads like `</noscript><img src=x onerror=alert(1)>` in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.",
  "severity": [
    {
      "type": "CVSS_V4",
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"
    }
  ],

advisories/github-reviewed/2026/03/GHSA-v2wj-7wpq-c8vv/GHSA-v2wj-7wpq-c8vv.json:16

• Dropping CVSS_V3 can be a compatibility break for downstream consumers that only ingest v3 vectors/scores. If the advisory previously carried CVSS v3, consider keeping it alongside CVSS v4 (or documenting why v3 is intentionally removed) to avoid reducing usability of the advisory data.

  "severity": [
    {
      "type": "CVSS_V4",
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"
    }
  ],

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.