DOMPurify is a sanitizer designed to prevent XSS by cleaning HTML, MathML, and SVG input. Versions from 3.0.1 up to but not including 3.4.0 are susceptible to a prototype pollution vulnerability that enables an attacker to bypass sanitization. Specifically, if an application uses DOMPurify.sanitize() with default settings (no CUSTOM_ELEMENT_HANDLING), a prior prototype pollution can inject permissive regular expressions into Object.prototype's tagNameCheck and attributeNameCheck properties. This manipulation causes DOMPurify to permit arbitrary custom elements and attributes, including event handlers, which can lead to XSS. The issue is resolved in version 3.4.0.

Successful exploitation allows an attacker to bypass DOMPurify's sanitization, enabling injection of arbitrary custom elements and attributes with event handlers. This can lead to cross-site scripting attacks that compromise confidentiality and integrity of web applications using vulnerable versions. The CVSS vector indicates network attack complexity is high, user interaction is required, and the impact on confidentiality is high while integrity impact is low and availability is unaffected.

Upgrade DOMPurify to version 3.4.0 or later, where this vulnerability is fixed. There is no official patch or temporary fix for earlier versions. Applications using affected versions should update promptly to prevent exploitation.