Issue Station
Sign In
Tools hereToolbox

n8n - 💡(How to fix) Fix security: upgrade dompurify to ≥3.3.2 (CVE-2025-26791, CVE-2025-15599, CVE-2026-0540)

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…

The lockfile pins [email protected]. Three unaddressed XSS vulnerabilities (CWE-79) affect this version, all fixed by upgrading to 3.3.2 or later.

CVECVSSAffected rangeFixed in
CVE-2025-267914.5 MEDIUMall versions < 3.2.43.2.4
CVE-2025-155995.1 MEDIUM≥ 3.1.33.2.7
CVE-2026-05405.1 MEDIUM≥ 3.1.33.3.2

None are actively exploited (no KEV, no public PoC), but all three are XSS vectors in a library used for HTML sanitization — particularly relevant given n8n's existing MCP/XSS advisories.

Root Cause

The lockfile pins [email protected]. Three unaddressed XSS vulnerabilities (CWE-79) affect this version, all fixed by upgrading to 3.3.2 or later.

CVECVSSAffected rangeFixed in
CVE-2025-267914.5 MEDIUMall versions < 3.2.43.2.4
CVE-2025-155995.1 MEDIUM≥ 3.1.33.2.7
CVE-2026-05405.1 MEDIUM≥ 3.1.33.3.2

None are actively exploited (no KEV, no public PoC), but all three are XSS vectors in a library used for HTML sanitization — particularly relevant given n8n's existing MCP/XSS advisories.

Fix Action

Fix / Workaround

The lockfile pins [email protected]. Three unaddressed XSS vulnerabilities (CWE-79) affect this version, all fixed by upgrading to 3.3.2 or later.

Code Example

pnpm update dompurify --filter ">=3.3.2"
RAW_BUFFERClick to expand / collapse

Summary

The lockfile pins [email protected]. Three unaddressed XSS vulnerabilities (CWE-79) affect this version, all fixed by upgrading to 3.3.2 or later.

CVECVSSAffected rangeFixed in
CVE-2025-267914.5 MEDIUMall versions < 3.2.43.2.4
CVE-2025-155995.1 MEDIUM≥ 3.1.33.2.7
CVE-2026-05405.1 MEDIUM≥ 3.1.33.3.2

None are actively exploited (no KEV, no public PoC), but all three are XSS vectors in a library used for HTML sanitization — particularly relevant given n8n's existing MCP/XSS advisories.

Recommended fix

pnpm update dompurify --filter ">=3.3.2"

or pin directly to 3.3.2 in the relevant package.json.

Discovery

Found via lockfile scan of pnpm-lock.yaml at [email protected] using VulnGraph MCP.

Note: CVE-2026-27606 (rollup) is already tracked in #27049.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#search optimization#API routing#API middleware#SSR setup#ISR setup

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING