dompurify@3.2.5

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions in the IN_PLACE process when DOM elements are passed from a different window or realm, such as an iframe's contentDocument. An attacker can inject and execute arbitrary scripts by supplying a crafted DOM element from a foreign realm, which bypasses sanitization and leaves malicious payloads intact. This is only exploitable if the application uses the IN_PLACE mode with DOM elements originating from a different window or realm.

Upgrade dompurify to version 3.4.4 or higher.

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the sanitize process. An attacker can execute arbitrary scripts in the context of the user’s browser by leveraging persistent function predicates supplied via ADD_ATTR or ADD_TAGS that are not cleared or overwritten across subsequent calls, allowing approval of attacker-controlled attributes or tags.

Upgrade dompurify to version 3.4.0 or higher.

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs in the CUSTOM_ELEMENT_HANDLING. An attacker can cause security-relevant attributes to be preserved on allowed custom elements by leveraging the bypass of the afterSanitizeElements hook, which may result in these attributes being re-injected into an HTML sink such as innerHTML and executed in a later context.

Note: This is only exploitable if the application enables CUSTOM_ELEMENT_HANDLING, relies on afterSanitizeElements as a security policy layer, and has custom elements that re-inject preserved attribute values into an HTML sink.

Upgrade dompurify to version 3.4.12 or higher.

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Improper Initialization in the DOMPurify.setConfig() API when an uponSanitizeAttribute hook is registered that mutates allowedAttributes. An attacker can cause persistent modification of the attribute allowlist by submitting specially crafted content, resulting in unauthorized attributes being permitted in all subsequent sanitization calls.

Upgrade dompurify to version 3.4.11 or higher.

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Protection Mechanism Failure through the clearConfig function. An attacker can execute arbitrary scripts in a Trusted Types sink by influencing a previously supplied TRUSTED_TYPES_POLICY on a reused instance and later triggering output with RETURN_TRUSTED_TYPE: true.

Note:

This is only exploitable if a DOMPurify instance is reused across trust boundaries and a less-trusted integration or attacker has previously set an unsafe Trusted Types policy.

Upgrade dompurify to version 3.4.9 or higher.

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the SAFE_FOR_TEMPLATES function. An attacker can inject template expressions that survive sanitization inside <template> element content by splitting malicious expressions across adjacent text nodes, which are not properly scrubbed. This allows execution of arbitrary code or exfiltration of sensitive data if a downstream template engine evaluates the merged content.

This is only exploitable if both SAFE_FOR_TEMPLATES: true and either RETURN_DOM: true, RETURN_DOM_FRAGMENT: true, or IN_PLACE: true are explicitly set, and the application processes <template>.content with a template engine.

Upgrade dompurify to version 3.4.8 or higher.

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Prototype Pollution in the IN_PLACE function when sanitizing a root element that is a <form> with event handler attributes and a descendant element whose name attribute matches certain property names checked by _isClobbered. An attacker can cause malicious attributes, such as event handlers or JavaScript URIs, to persist on the root element by crafting a DOM structure where the root is clobbered and then passing it to the sanitizer in IN_PLACE mode. This allows the attacker to execute arbitrary JavaScript or bypass attribute-level defenses when the sanitized node is reinserted into the live document.

Note:

This is only exploitable if the sanitizer is used in IN_PLACE mode on a detached root element that is an HTMLFormElement with a clobber-named child.

Upgrade dompurify to version 3.4.6 or higher.

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Trust Boundary Violation in the sanitize function when handling DOM nodes from a different same-origin realm due to improper realm-bound instanceof checks. An attacker can inject and execute malicious markup by providing specially crafted DOM nodes from a foreign realm, which bypass internal security checks and allow executable content to persist in form attributes, template content, and attached shadow roots.

Upgrade dompurify to version 3.4.6 or higher.

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Trust Boundary Violation through the mutation of data.allowedTags or data.allowedAttributes in hooks, which directly alters the global default sets used for sanitization. An attacker can cause persistent changes to the default allow-lists, enabling malicious tags or attributes to bypass sanitization in subsequent calls by injecting payloads that exploit the polluted configuration.

Note:

This is only exploitable if a hook is registered that mutates data.allowedTags or data.allowedAttributes, and later sanitization occurs without explicitly setting restrictive configuration arrays.

Upgrade dompurify to version 3.4.7 or higher.

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the IN_PLACE function when handling a <template> element containing an element with an attached shadow DOM. An attacker can execute arbitrary scripts in the context of the user by injecting malicious content into the shadow DOM, which is not sanitized and is later executed when the template is cloned and inserted into the page.

Upgrade dompurify to version 3.4.7 or higher.

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the IN_PLACE process when attacker-controlled live DOM nodes are sanitized. An attacker can execute arbitrary scripts in the context of the application by passing a manipulated DOM node with a spoofed nodeName property, causing malicious script elements to be retained and executed upon insertion into the document.

Upgrade dompurify to version 3.4.8 or higher.

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) leading to cross-site scripting, via custom elements. When CUSTOM_ELEMENT_HANDLING is not enabled, and an attacker has already polluted the prototype of objects supplied to DOMPurify.sanitize(), the tagNameCheck and attributeNameCheck regex values allow arbitrary custom elements including event handlers to bypass sanitization.

Upgrade dompurify to version 3.4.0 or higher.

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via templates injected to a site in RETURN_DOM mode. The SAFE_FOR_TEMPLATES sanitization can be bypassed, which then allows scripts to be executed if the template is evaluated by a framework such as Vue 2. An application is only vulnerable if it has SAFE_FOR_TEMPLATES: true, and RETURN_DOM: true or RETURN_DOM_FRAGMENT: true set.

Upgrade dompurify to version 3.4.0 or higher.

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Operator Precedence Logic Error in the form of short-circuit evaluation that gives precedence to ADD_TAGS over FORBID_TAGS in _sanitizeElements(). In an application where ADD_TAGS is used as a function (via EXTRA_ELEMENT_HANDLING.tagCheck) and FORBID_TAGS is in use, an attacker can cause forbidden tags to be allowed.

Upgrade dompurify to version 3.4.0 or higher.

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Permissive List of Allowed Inputs in the ADD_ATTR predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck. An attacker can inject and execute malicious scripts in the DOM by bypassing URI validation for specific attribute and tag combinations, such as allowing href attributes with unsafe protocols like javascript:.

Upgrade dompurify to version 3.3.2 or higher.

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Prototype Pollution in the USE_PROFILES function. An attacker can execute arbitrary JavaScript code in the context of the user’s browser by polluting Array.prototype with event handler attributes, causing the sanitizer to incorrectly allow dangerous attributes such as onclick.

Upgrade dompurify to version 3.3.2 or higher.

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) when sanitized HTML is reinserted into a new parsing context using innerHTML and special wrappers such as script, xmp, iframe, noembed, noframes, or noscript. An attacker can execute arbitrary JavaScript code in the client by crafting input that closes the special parsing context early and injects malicious markup, which is then interpreted during the second parse.

Upgrade dompurify to version 3.3.2 or higher.

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the createDOMPurify() function, via comments embedded in XML textarea attributes containing scripts.

Upgrade dompurify to version 3.2.7 or higher.