Executive brief
DOMPurify is a popular JavaScript library used by web applications to sanitize user-supplied HTML and prevent cross-site scripting (XSS) attacks. When an application uses DOMPurify with default settings and another prototype pollution vulnerability exists in the same JavaScript context, an attacker can bypass the XSS protections by poisoning object prototypes, allowing malicious HTML with event handlers to pass through sanitization. This could enable account takeover or data theft if the sanitized content is displayed to users.
Technical details
This vulnerability exploits a prototype pollution chain in DOMPurify versions 3.0.1–3.3.3. At line 590 of purify.js, when CUSTOM_ELEMENT_HANDLING is not provided in the config, the code assigns a plain object `{}` which inherits from Object.prototype. An attacker with a separate prototype pollution primitive (e.g., via vulnerable lodash or jQuery.extend in the same execution context) can pollute Object.prototype.tagNameCheck and Object.prototype.attributeNameCheck with permissive regex values (e.g., `/.*/`). The sanitizer then resolves these properties via the prototype chain instead of using its default restrictions, allowing custom elements and event handler attributes through. The attack requires both a prototype pollution gadget and that the victim view the injected content, but prototype pollution vulnerabilities are widespread in JavaScript libraries. Fix: use Object.create(null) instead of `{}` to prevent prototype chain inheritance, or explicitly provide CUSTOM_ELEMENT_HANDLING in the config.
Affected products
- cure53 DOMPurify 3.0.1 through 3.3.3
Timeline
- 2026-04-20: disclosed
- 2026-04-20: patched: Fixed in version 3.4.0