Executive brief
DOMPurify is a popular open-source JavaScript library used to sanitize HTML and prevent cross-site scripting (XSS) attacks on web applications. A prototype pollution vulnerability in the library allows attackers to tamper with JavaScript object prototypes, potentially bypassing the sanitization logic and injecting malicious scripts. This could compromise the security of any web application relying on DOMPurify for HTML sanitization.
Technical details
DOMPurify is vulnerable to prototype pollution (CWE-1321), which allows an attacker to modify object prototype attributes through specially crafted input. The vulnerability is network-accessible with low attack complexity, requiring no user interaction or privileges. An attacker can exploit this to bypass DOMPurify's sanitization filters and achieve script injection, potentially leading to arbitrary code execution in the browser context of affected applications. The vulnerability affects all versions prior to 2.4.2, which includes the fix committed as d1dd0374caef2b4c56c3bd09fe1988c3479166dc.
Affected products
- cure53 DOMPurify < 2.4.2
Timeline
- 2024-10-31: disclosed
- 2024-10-31: patched: Version 2.4.2 includes fix