monaco-editor@0.56.0 depends on dompurify@3.4.8.
Two DOMPurify advisories land above that version:
DOMPurify 3.4.13 is current on npm.
Why this matters to embedders specifically
DOMPurify is bundled into the shipped monaco artifacts (e.g. min/vs/editor.api-*.js) rather than resolved at the consumer's dependency graph. That means downstream consumers cannot upgrade it themselves — the only options are to hand-patch a third-party bundle, or wait.
In practice it surfaces as a "Vulnerable JS Library" finding against every site embedding Monaco, and there is no consumer-side remediation to offer in response.
Would you consider bumping the DOMPurify dependency to 3.4.12 or later?
Note on severity
I appreciate Monaco uses DOMPurify for its own internal sanitisation (markdown in hovers, suggestion documentation and similar), so the practical exposure for many embedders is lower than a raw CVE count suggests. This is raised as dependency hygiene and to remove a recurring, unactionable scanner finding for embedders, not as a report of an exploitable path in Monaco itself.
monaco-editor@0.56.0depends ondompurify@3.4.8.Two DOMPurify advisories land above that version:
DOMPurify 3.4.13 is current on npm.
Why this matters to embedders specifically
DOMPurify is bundled into the shipped monaco artifacts (e.g.
min/vs/editor.api-*.js) rather than resolved at the consumer's dependency graph. That means downstream consumers cannot upgrade it themselves — the only options are to hand-patch a third-party bundle, or wait.In practice it surfaces as a "Vulnerable JS Library" finding against every site embedding Monaco, and there is no consumer-side remediation to offer in response.
Would you consider bumping the DOMPurify dependency to 3.4.12 or later?
Note on severity
I appreciate Monaco uses DOMPurify for its own internal sanitisation (markdown in hovers, suggestion documentation and similar), so the practical exposure for many embedders is lower than a raw CVE count suggests. This is raised as dependency hygiene and to remove a recurring, unactionable scanner finding for embedders, not as a report of an exploitable path in Monaco itself.