# cure53/DOMPurify

DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:

Repository: https://github.com/cure53/DOMPurify
Canonical: https://ross.abutalabs.com/products/dompurify
Homepage: https://cure53.de/purify
Language: JavaScript
License: Apache-2.0
License Family: permissive
Topics: xss, sanitizer, dom, security, javascript, dompurify, prevent-xss-attacks, mathml, html, svg, cross-site-scripting
Last push: 2026-08-24T06:24:16+00:00

## Health v2 (maintenance only)
Score: 99/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 98, longevity 100
- inputs: {"age_days": 4580, "days_push": 9, "days_rel": 14, "gap_med": 9, "n_releases_24m": 30}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 17339, forks 858 (observed 2026-08-28T04:11:17.975502+00:00)

## What it is
DOMPurify is a fast, DOM-only XSS sanitizer for HTML, MathML and SVG that removes malicious markup while allowing safe content. It works in all modern browsers and Node.js via jsdom, with secure defaults plus extensive configuration and hooks.

## Use cases
- sanitize user-submitted html to prevent xss
- clean rich text before rendering in the browser
- allow safe svg and mathml content from untrusted sources
- sanitize html server-side in node.js
- strip dangerous attributes and tags from markup
- prevent cross-site scripting attacks in a web app

## When to choose
- you render untrusted HTML, SVG, or MathML and need battle-tested XSS protection
- you want secure defaults with fine-grained allowlist and hook configuration
- you need a small, fast, dependency-free sanitizer across browsers and Node.js

## When to avoid
- you need to sanitize non-HTML formats like Markdown, CSS, or JSON
- you must support legacy MSIE and need the maintained 2.x branch instead
- you want a full CSP or Trusted Types policy rather than markup sanitization

## Facets
- artifact type: library
- maturity: stable
- function: security, web-framework, frontend-framework
- domain: security, web-development, frontend
- platform: browser
- tags: xss, sanitizer, html-sanitization, dom, svg, mathml, input-sanitization, nodejs, javascript

## Member repositories
- cure53/DOMPurify (main) score 99

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:11:17.975502+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T17:03:11.171838+00:00, confidence not recorded.
  - readme: https://github.com/cure53/DOMPurify (fetched 2026-08-28T04:11:17.975502+00:00, sha 6638e1097431)
  - homepage: https://cure53.de/purify (fetched 2026-08-29T08:01:39.153221+00:00, sha 4c6a2ee88532)
- Data as of 2026-08-30T08:39:29.467469+00:00.