Executive brief
DOMpurify is a widely-used JavaScript library that sanitizes HTML to prevent malicious code injection in web applications. A nesting-based mutation XSS (mXSS) vulnerability allows attackers to bypass the sanitization and inject malicious scripts, potentially compromising user data integrity and enabling unauthorized actions within web applications using affected versions.
Technical details
DOMpurify contains a nesting-based mutation XSS (mXSS) vulnerability classified as CWE-79 (improper neutralization of input during web page generation). The vulnerability is exploitable over the network with no authentication or user interaction required, affecting the scope of the application. An attacker can craft specially nested HTML/script payloads that bypass DOMpurify's sanitization, resulting in malicious script execution with high impact on integrity and availability. The vulnerability was fixed in version 2.5.0 (2.x branch) and version 3.1.3 (3.x branch); a proof of concept is available in the project's test suite.
Affected products
- cure53 DOMpurify < 2.5.0 and 3.0.0 to < 3.1.3
Timeline
- 2024-10-11: disclosed: GHSA-gx9m-whjm-85jf published
- 2024-10-11: patched: Fixed in versions 2.5.0 and 3.1.3