dompurify@0.8.9

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the IN_PLACE sanitization process when a hook removes an element, leaving its detached descendants with executable event handlers. An attacker can execute arbitrary JavaScript code in the application's origin by supplying crafted HTML that leverages this behavior. This is only exploitable if the application uses the IN_PLACE configuration along with a hook that removes a containing element.

Upgrade dompurify to version 3.4.13 or higher.

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions in the IN_PLACE process when DOM elements are passed from a different window or realm, such as an iframe's contentDocument. An attacker can inject and execute arbitrary scripts by supplying a crafted DOM element from a foreign realm, which bypasses sanitization and leaves malicious payloads intact. This is only exploitable if the application uses the IN_PLACE mode with DOM elements originating from a different window or realm.

Upgrade dompurify to version 3.4.4 or higher.

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the sanitize process. An attacker can execute arbitrary scripts in the context of the user’s browser by leveraging persistent function predicates supplied via ADD_ATTR or ADD_TAGS that are not cleared or overwritten across subsequent calls, allowing approval of attacker-controlled attributes or tags.

Upgrade dompurify to version 3.4.0 or higher.

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs in the CUSTOM_ELEMENT_HANDLING. An attacker can cause security-relevant attributes to be preserved on allowed custom elements by leveraging the bypass of the afterSanitizeElements hook, which may result in these attributes being re-injected into an HTML sink such as innerHTML and executed in a later context.

Note: This is only exploitable if the application enables CUSTOM_ELEMENT_HANDLING, relies on afterSanitizeElements as a security policy layer, and has custom elements that re-inject preserved attribute values into an HTML sink.

Upgrade dompurify to version 3.4.12 or higher.

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Improper Initialization in the DOMPurify.setConfig() API when an uponSanitizeAttribute hook is registered that mutates allowedAttributes. An attacker can cause persistent modification of the attribute allowlist by submitting specially crafted content, resulting in unauthorized attributes being permitted in all subsequent sanitization calls.

Upgrade dompurify to version 3.4.11 or higher.

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Protection Mechanism Failure through the clearConfig function. An attacker can execute arbitrary scripts in a Trusted Types sink by influencing a previously supplied TRUSTED_TYPES_POLICY on a reused instance and later triggering output with RETURN_TRUSTED_TYPE: true.

Note:

This is only exploitable if a DOMPurify instance is reused across trust boundaries and a less-trusted integration or attacker has previously set an unsafe Trusted Types policy.

Upgrade dompurify to version 3.4.9 or higher.

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Prototype Pollution in the IN_PLACE function when sanitizing a root element that is a <form> with event handler attributes and a descendant element whose name attribute matches certain property names checked by _isClobbered. An attacker can cause malicious attributes, such as event handlers or JavaScript URIs, to persist on the root element by crafting a DOM structure where the root is clobbered and then passing it to the sanitizer in IN_PLACE mode. This allows the attacker to execute arbitrary JavaScript or bypass attribute-level defenses when the sanitized node is reinserted into the live document.

Note:

This is only exploitable if the sanitizer is used in IN_PLACE mode on a detached root element that is an HTMLFormElement with a clobber-named child.

Upgrade dompurify to version 3.4.6 or higher.

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Trust Boundary Violation in the sanitize function when handling DOM nodes from a different same-origin realm due to improper realm-bound instanceof checks. An attacker can inject and execute malicious markup by providing specially crafted DOM nodes from a foreign realm, which bypass internal security checks and allow executable content to persist in form attributes, template content, and attached shadow roots.

Upgrade dompurify to version 3.4.6 or higher.

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Trust Boundary Violation through the mutation of data.allowedTags or data.allowedAttributes in hooks, which directly alters the global default sets used for sanitization. An attacker can cause persistent changes to the default allow-lists, enabling malicious tags or attributes to bypass sanitization in subsequent calls by injecting payloads that exploit the polluted configuration.

Note:

This is only exploitable if a hook is registered that mutates data.allowedTags or data.allowedAttributes, and later sanitization occurs without explicitly setting restrictive configuration arrays.

Upgrade dompurify to version 3.4.7 or higher.

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the IN_PLACE function when handling a <template> element containing an element with an attached shadow DOM. An attacker can execute arbitrary scripts in the context of the user by injecting malicious content into the shadow DOM, which is not sanitized and is later executed when the template is cloned and inserted into the page.

Upgrade dompurify to version 3.4.7 or higher.

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the IN_PLACE process when attacker-controlled live DOM nodes are sanitized. An attacker can execute arbitrary scripts in the context of the application by passing a manipulated DOM node with a spoofed nodeName property, causing malicious script elements to be retained and executed upon insertion into the document.

Upgrade dompurify to version 3.4.8 or higher.

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Operator Precedence Logic Error in the form of short-circuit evaluation that gives precedence to ADD_TAGS over FORBID_TAGS in _sanitizeElements(). In an application where ADD_TAGS is used as a function (via EXTRA_ELEMENT_HANDLING.tagCheck) and FORBID_TAGS is in use, an attacker can cause forbidden tags to be allowed.

Upgrade dompurify to version 3.4.0 or higher.

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Permissive List of Allowed Inputs in the ADD_ATTR predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck. An attacker can inject and execute malicious scripts in the DOM by bypassing URI validation for specific attribute and tag combinations, such as allowing href attributes with unsafe protocols like javascript:.

Upgrade dompurify to version 3.3.2 or higher.

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Prototype Pollution in the USE_PROFILES function. An attacker can execute arbitrary JavaScript code in the context of the user’s browser by polluting Array.prototype with event handler attributes, causing the sanitizer to incorrectly allow dangerous attributes such as onclick.

Upgrade dompurify to version 3.3.2 or higher.

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) when sanitized HTML is reinserted into a new parsing context using innerHTML and special wrappers such as script, xmp, iframe, noembed, noframes, or noscript. An attacker can execute arbitrary JavaScript code in the client by crafting input that closes the special parsing context early and injects malicious markup, which is then interpreted during the second parse.

Upgrade dompurify to version 3.3.2 or higher.

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the createDOMPurify() function, via comments embedded in XML textarea attributes containing scripts.

Upgrade dompurify to version 3.2.7 or higher.

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the createDOMPurify() function, via comments embedded in XML noscript, xmp, noembed, noframes, and iframe attributes containing scripts.

Upgrade dompurify to version 2.5.9, 3.3.2 or higher.

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to incorrect handling of template literals in regular expressions. An attacker can manipulate the output of the script by injecting malicious payloads that bypass the dompurify sanitization.

Upgrade dompurify to version 3.2.4 or higher.

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Prototype Pollution due to improper checks of the properties during the HTML sanitization process.

Upgrade dompurify to version 2.4.2 or higher.

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) through the improper sanitization of nested HTML elements in the createDOMPurify function when traversing deeply nested elements. This can be triggered by passing malicious inputs to the sanitize() function without checking their depth.

Upgrade dompurify to version 2.5.0, 3.1.3 or higher.

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Prototype Pollution due to improper user input sanitization through the depth-checking mechanism, an attacker can exploit this vulnerability by using special nesting techniques to create a malicious HTML file.

Upgrade dompurify to version 2.5.4, 3.1.3 or higher.

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Template Injection in purify.js, due to inconsistencies in the parsing of XML and HTML tags. Executable code can be injected in HTML inside XML CDATA blocks.

Upgrade dompurify to version 2.4.9, 3.0.11 or higher.

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Open Redirect in the hooks-target-blank-demo.html demo, via reverse tabnabbing. An attacker can redirect users to a malicious website by exploiting the lack of rel="noopener noreferrer" attribute in links.

Upgrade dompurify to version 1.0.11 or higher.

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). This is due to a bypass of a previous XSS vulnerability.

Upgrade dompurify to version 2.2.3 or higher.

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) when converting from SVG namespace.

Upgrade dompurify to version 2.2.2 or higher.

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as demonstrated by nesting of FORM elements.

Upgrade dompurify to version 2.0.17 or higher.