DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability is fixed in 2.4.2.
Prototype pollution consists of the ability to modify the base prototype of a JavaScript object (Object.prototype) through unauthorized input data. In the case of DOMPurify, an attacker could provide a crafted payload that during the sanitization process caused prototype contamination. This resulted in the possibility of influencing the behavior of all objects in the application using the library, which could ultimately lead to bypassing XSS protection mechanisms.
An attacker can modify the properties of global JavaScript objects in the application, which leads to violation of data integrity and confidentiality — including potential execution of malicious scripts (XSS) in the context of the victim's browser.
DOMPurify should be updated to version 2.4.2 or newer, in which the vulnerability has been fixed. A patch is available in the project repository on GitHub.
Cure53 DOMPurify library in versions prior to 2.4.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NCure53 Dompurify
APPCure53< 2.4.2
Related vulnerabilities
DOMPurify — podatność mXSS oparta na zagnieżdżaniu znaczników
XSS w DOMPurify — bypass sanityzacji przez element <selectedcontent>
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has been discove...
DOMPurify przed wersją 3.4.12 nie wykonuje hook'a afterSanitizeElements dla custom elements dozwolonych przez ...
DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitiz...