Executive brief
DOMPurify, a library used to clean HTML and prevent cross-site scripting (XSS), contains a flaw where certain custom plugins (hooks) can accidentally corrupt the library's global security settings. If a developer uses a hook to temporarily allow a specific HTML tag or attribute, that tag may become permanently allowed for all future users of the application. This could allow an attacker to bypass security filters and execute malicious scripts in other parts of the website.
Technical details
A trust boundary violation (CWE-501) exists in DOMPurify due to the way `data.allowedTags` and `data.allowedAttributes` are handled in `uponSanitizeElement` and `uponSanitizeAttribute` hooks. These fields are direct references to the internal `ALLOWED_TAGS` and `ALLOWED_ATTR` sets, which in turn reference the module-level `DEFAULT_ALLOWED_TAGS` constants when no explicit configuration is provided. If a hook mutates these sets (e.g., `data.allowedTags['script'] = true`), the change persists globally for the lifetime of the DOMPurify instance. This bypasses subsequent sanitization attempts even after hooks are removed or the configuration is cleared. The vulnerability is fixed in version 3.4.7 by ensuring hooks receive defensive copies or that defaults are cloned before mutation.
Affected products
- cure53 DOMPurify < 3.4.7
Timeline
- 2026-06-15: advisory: GitHub Advisory GHSA-76mc-f452-cxcm published.
- 2026-06-15: patched: Fixed in version 3.4.7.