microsoft / microsoft/monaco-editor
[Bug] Update dompurify to >= 3.4.9
@hediet is already working on this.
Since Jun 9, 2026.
- Dominant language
- JavaScript
- Stars
- 46.8k
- Forks
- 4.1k
- Avg merge
- 17h 58m
- Merged PRs (30d)
- 1
Description
Reproducible in vscode.dev or in VS Code Desktop?
- Not reproducible in vscode.dev or VS Code Desktop
Reproducible in the monaco editor playground?
- Not reproducible in the monaco editor playground
Monaco Editor Playground Link
dompurify package contains multiple vulnerabilities pls update referenced dompurify to minimal version 3.4.9 .
Here is list of vulnerabilities
`
SEVERITY CVSS PACKAGE FIXED CVE/GHSA
MEDIUM 5.3 dompurify 3.4.0 GHSA-39q2-94rc-95cp
MEDIUM 5.3 dompurify 3.3.2 GHSA-cj63-jhhr-wcxv
MEDIUM 5.3 dompurify 3.3.2 GHSA-cjmm-f4jc-qw8r
MEDIUM 6.8 dompurify 3.4.0 GHSA-crv5-9vww-q3g8
MEDIUM 6.0 dompurify 3.4.0 GHSA-h7mw-gpvr-xq4m
MEDIUM 6.9 dompurify 3.3.2 GHSA-h8r8-wccr-v5f2
MEDIUM 6.1 dompurify 3.3.2 GHSA-v2wj-7wpq-c8vv
MEDIUM 6.9 dompurify 3.4.0 GHSA-v9jr-rg53-9pgp
MEDIUM 4.5 dompurify 3.2.4 GHSA-vhxf-7vqr-mrjg
`
Monaco Editor Playground Code
Reproduction Steps
No response
Actual (Problematic) Behavior
No response
Expected Behavior
No response
Additional Context
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.