cure53 DOMPurify XSS via IN_PLACE hook removal

Executive brief

DOMPurify is a popular library used to clean HTML and prevent malicious code from running in web browsers. A flaw in how it handles specific custom configurations allows an attacker to bypass security checks and execute unauthorized JavaScript (Cross-Site Scripting). This could lead to the theft of user data or unauthorized actions being performed on behalf of a user.

Technical details

A cross-site scripting (XSS) vulnerability exists in DOMPurify versions up to 3.4.12. When the library is configured with 'IN_PLACE: true' and utilizes a hook (such as 'uponSanitizeElement') to remove an element, the '_sanitizeElements()' function returns early without calling '_neutralizeSubtree()'. This failure to neutralize the detached subtree allows descendant elements, such as images with 'onload' handlers, to retain and execute malicious JavaScript even after the sanitization process completes. The vulnerability is triggered if a browser queues a resource event while the application is constructing the dirty root. This issue is resolved in version 3.4.13 by ensuring the subtree is neutralized before the hook-detachment branch returns.

Affected products

• cure53 dompurify <= 3.4.12

Timeline

• 2026-08-03: disclosed
• 2026-08-07: advisory
• 2026-08-07: patched: Fixed in version 3.4.13

References

• https://api.github.com/users/koyokr
• https://github.com/koyokr
• https://api.github.com/users/koyokr/gists%7B/gist_id%7D
• https://api.github.com/users/koyokr/repos
• https://avatars.githubusercontent.com/u/20319256?v=4
• https://api.github.com/users/koyokr/events%7B/privacy%7D