Threat Intelligence Database

DOMPurify versions before 3.4.16 contain a cross-site scripting (XSS) vulnerability. This flaw arises because the IN_PLACE mode returns a forcibly removed style element whose text content still includes markup. An attacker can exploit this by supplying a crafted style element containing a closing style tag and an img onerror payload, which executes script when the application serializes and re-parses the node.

DOMPurify versions 3.4.13 through 3.4.15 contain a cross-site scripting (XSS) vulnerability. The issue arises because the IN_PLACE mode does not properly neutralize subtrees detached by afterSanitizeElements or afterSanitizeAttributes hooks. This allows attackers to inject markup with event handlers that remain active on the live DOM, enabling script execution in the victim's origin.

DOMPurify versions before 3.4.13 contain a cross-site scripting (XSS) vulnerability in the IN_PLACE sanitization method. The vulnerability arises because element-removal hooks fail to neutralize detached subtrees, allowing attackers to inject HTML with event handlers on descendant elements that execute after sanitization. This occurs even though the returned root element appears clean after sanitization.

DOMPurify versions prior to 3.4.13 contain a vulnerability in the IN_PLACE sanitization mode where a hook that removes an element can leave detached descendant elements executable. This allows an attacker who can supply HTML to execute JavaScript via retained event handlers on detached subtrees after sanitization completes. The issue arises because the sanitization process skips neutralizing the subtree of a detached node when a hook removes it, leaving event handlers intact on disconnected elements.

DOMPurify versions before 3.4.12 have a vulnerability where the afterSanitizeElements hook is not executed for custom elements allowed via CUSTOM_ELEMENT_HANDLING.tagNameCheck. This allows attributes on these custom elements to bypass security policies, potentially enabling second-order cross-site scripting (XSS) attacks by preserving sensitive attributes that are later re-injected into innerHTML sinks.

DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOM_ELEMENT_HANDLING.tagNameCheck, allowing attributes to bypass application security policies. Attackers can preserve sensitive attributes on custom elements that later re-inject them into innerHTML sinks, creating second-order XSS gadgets.

DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as allowlisted attributes and resulting in DOM-based XSS when sanitized markup is rendered.

In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) across subsequent sanitize() calls on the same instance. If a later call on the same instance provides ADD_ATTR or ADD_TAGS as an array rather than a function, the previously set function handler is neither cleared nor overwritten, so it continues to approve attacker-controlled attributes or tags. This can allow dangerous event-handler attributes or forbidden tags (bypassing FORBID_TAGS) to survive sanitization, resulting in cross-site scripting. The vendor (Cure53) considers this an edge case outside DOMPurify's threat model; the referenced advisory lists 3.4.0 as the patched version.

DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument). A cross-realm instanceof check in the private _isNode() function returns false for foreign-realm nodes, causing DOMPurify to stringify the element (yielding '[object HTMLDivElement]'), silently reset IN_PLACE to false, and return the unsanitized element unchanged with any XSS payloads intact.

DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions. Attackers can craft input containing tags listed in FORBID_TAGS that are also added via ADD_TAGS function, causing them to be retained in sanitized output.