cure53 DOMPurify hook bypass in CUSTOM_ELEMENT_HANDLING

Executive brief

DOMPurify, a library used to clean HTML and prevent cross-site scripting (XSS), contains a logic flaw when handling custom HTML elements. If a developer configures the library to allow specific custom elements and also uses custom 'hooks' to strip sensitive data, those hooks may be skipped for the custom elements. This could allow malicious data to remain on the page and potentially execute if the custom element later processes that data insecurely.

Technical details

A logic inconsistency exists in DOMPurify's _sanitizeElements function. When an element is processed via the CUSTOM_ELEMENT_HANDLING.tagNameCheck path, the function returns early from _sanitizeDisallowedNode. This early return bypasses subsequent logic in _sanitizeElements, including namespace validation, mXSS checks, and the afterSanitizeElements hook dispatch. If an application relies on this hook to enforce security policies (e.g., stripping specific attributes), those policies will not be applied to custom elements. This creates a second-order XSS vulnerability if the custom element later uses the preserved attributes in a dangerous sink like innerHTML.

Affected products

• cure53 DOMPurify <= 3.4.11

Timeline

• 2026-07-11: advisory: Initial advisory published
• 2026-07-21: disclosed: Updated advisory details released
• 3.4.12: patched

References

• https://api.github.com/users/Rikuxx0
• https://github.com/Rikuxx0
• https://api.github.com/users/Rikuxx0/gists%7B/gist_id%7D
• https://api.github.com/users/Rikuxx0/repos
• https://avatars.githubusercontent.com/u/138118002?v=4
• https://api.github.com/users/Rikuxx0/events%7B/privacy%7D