Executive brief
DOMPurify is a library used to clean up web content to prevent malicious scripts from running. A vulnerability exists where the library can be tricked into ignoring malicious script tags if they are hidden inside specially crafted web objects. If an application uses the 'IN_PLACE' sanitization mode on objects provided by a less-trusted part of the site (like an iframe), an attacker could execute unauthorized code in the user's browser, potentially leading to data theft or account takeover.
Technical details
A cross-site scripting (XSS) vulnerability exists in DOMPurify when using the `IN_PLACE: true` configuration. The root cause is that the `_sanitizeElements` pipeline trusts the `nodeName` property of live DOM nodes for non-form elements, which can be shadowed or redefined by an attacker. By passing a live DOM node from a same-origin subcontext (such as an iframe or popup) where a `<script>` tag's `nodeName` has been redefined to an allowed tag like `DIV`, the malicious script bypasses the sanitizer's removal logic. This affects version 3.4.6 and earlier; string-based sanitization is not impacted. Security engineers should ensure that sanitization logic uses trusted prototype getters rather than instance-visible properties.
Affected products
- cure53 DOMPurify <= 3.4.6
Timeline
- 2026-05-27: advisory: GitHub Advisory published
- 2026-06-15: disclosed