Executive brief
DOMPurify is a widely-used JavaScript HTML sanitization library that removes potentially dangerous content from user-supplied HTML. A configuration inconsistency allows attackers to bypass tag blocking rules when using function-based tag allowlists, potentially injecting malicious iframe, form, and other elements with external URLs. This could enable credential theft, data exfiltration, and XSS attacks in applications that rely on FORBID_TAGS to block dangerous elements.
Technical details
This vulnerability is a logic bypass (CWE-183) in DOMPurify's tag sanitization flow. The root cause is asymmetric handling of FORBID_TAGS and ADD_TAGS: a prior fix (commit c361baa) added an early exit for FORBID_ATTR before checking ADD_ATTR, but the same logic was not applied to tags. When EXTRA_ELEMENT_HANDLING.tagCheck is a function that returns true, short-circuit evaluation in the conditional at lines 1118–1123 skips the FORBID_TAGS check entirely, allowing forbidden tags like iframe, form, object, and embed to pass through with their attributes intact. The vulnerability requires a function-based ADD_TAGS predicate in the configuration (uncommon but legitimate usage). An attacker who controls the sanitizer configuration and input HTML can inject dangerous elements; impact depends on the application context but includes XSS, phishing (form injection), and data theft (iframe with external action/src).
Affected products
- Cure53 DOMPurify <= 3.2.6
Timeline
- 2026-04-22: disclosed: Advisory published
- 2026-04-20: patched: Fix released in version 3.4.0