Executive brief
DOMPurify, a popular library used to clean and sanitize web content to prevent security attacks, contains a flaw when processing content in a specific "in-place" mode. This vulnerability allows malicious code to bypass security filters if the content is handled across different parts of a web application (such as between an iframe and the main page). If exploited, an attacker could execute unauthorized scripts in a user's browser, potentially leading to data theft or account takeover.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in DOMPurify when using `DOMPurify.sanitize(node, { IN_PLACE: true })`. The root cause is a trust boundary violation where the library accepts same-origin foreign-realm DOM nodes (e.g., from an iframe) but performs security checks using `instanceof` against parent-realm constructors. Because constructors are realm-specific, checks for `HTMLFormElement`, `NamedNodeMap`, and `DocumentFragment` fail for foreign-realm nodes. This causes the sanitizer to skip critical branches for DOM clobbering protection, template content sanitization, and Shadow DOM inspection. An attacker can provide malicious markup that survives the sanitization process and executes when the node is later activated or inserted into the main document. This issue is fixed in version 3.4.6 by hardening cross-realm checks.
Affected products
- cure53 DOMPurify < 3.4.6
Timeline
- 2026-05-26: patched: Version 3.4.6 released
- 2026-07-14: advisory: GitHub Security Advisory published