Executive brief
DOMPurify is a widely-used JavaScript library that sanitizes user-supplied HTML to prevent malicious code injection. A flaw in versions before 2.0.17 allows attackers to bypass sanitization through DOM mutation during namespace transitions (from HTML to MathML), enabling injection of malicious scripts that execute in users' browsers. This could compromise user sessions, steal credentials, or deface application content.
Technical details
This is a mutation-based cross-site scripting (XSS) vulnerability (CWE-79) in DOMPurify's HTML sanitization logic. The root cause is that DOMPurify's serialize-parse roundtrip does not preserve the original DOM tree structure when namespace transitions occur, particularly when HTML elements are nested within FORM elements that later transition to MathML context. An attacker can craft a malicious HTML payload that exploits this mutation behavior to bypass the sanitization filter and inject executable script tags. The attack requires user interaction (the sanitized content must be rendered in a browser) but no authentication. The vulnerability was patched in version 2.0.17 by improving namespace handling during the serialize-parse cycle.
Affected products
- Cure53 DOMPurify before 2.0.17
Timeline
- 2020-10-07: disclosed
- 2020-12-18: advisory
- 2020-12-18: patched: Fixed in version 2.0.17