Executive brief
DOMPurify is a widely-used JavaScript library that sanitizes HTML and prevents malicious code injection. A vulnerability allows attackers to bypass its attribute sanitization by exploiting missing protections for certain HTML elements (noscript, xmp, noembed, noframes, iframe), potentially leading to unauthorized JavaScript execution in users' browsers when they view malicious content.
Technical details
DOMPurify 3.1.3–3.3.1 and 2.5.3–2.5.8 contain a cross-site scripting vulnerability stemming from incomplete regex patterns in the SAFE_FOR_XML configuration. The vulnerability allows attackers to inject payloads like </noscript><img src=x onerror=alert(1)> into sanitized attribute values; when the sanitized output is placed inside rawtext contexts (noscript, xmp, noembed, noframes, or iframe elements), the injected payload executes as JavaScript. The attack requires user interaction (rendering sanitized content in a browser) but does not require authentication or special network positioning. The vendor released fixed versions 2.5.9 and 3.3.2 to expand the SAFE_FOR_XML regex and properly handle these rawtext elements.
Affected products
- Cure53 DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8
Timeline
- 2026-03-03: disclosed
- 2026-03-04: patched: Fixed versions 2.5.9 and 3.3.2 released