Executive brief
DOMPurify is a widely-used JavaScript library that sanitizes HTML to prevent malicious code injection in web applications. When the SAFE_FOR_TEMPLATES mode is enabled, an incorrect regex pattern allows attackers to bypass sanitization and inject malicious scripts, potentially leading to account compromise or data theft for users of affected applications.
Technical details
This is a mutation cross-site scripting (mXSS) vulnerability in DOMPurify's template literal regular expression handling when SAFE_FOR_TEMPLATES is enabled. The root cause is an incorrect regex pattern that fails to properly sanitize template literals under certain configurations, allowing attackers to craft payloads that pass the sanitization filter and later execute as JavaScript in the DOM. The vulnerability affects all versions prior to 3.2.4 and requires no authentication or user interaction beyond visiting a page with malicious content. An attacker can achieve arbitrary JavaScript execution in the browser context of the vulnerable application. The fix was released in version 3.2.4 with an updated template literal regex pattern.
Affected products
- Cure53 DOMPurify before 3.2.4
Timeline
- 2025-02-14: disclosed
- 2025-02-14: patched: Fixed in version 3.2.4