Executive brief
DOMPurify is a security library used to clean HTML and prevent malicious scripts from running in web browsers. A flaw in its "in-place" sanitization mode allows an attacker to bypass security checks by using a technique called DOM Clobbering. If a developer uses this specific mode to sanitize a form that contains malicious elements, the library may fail to remove dangerous event handlers (like "onclick"), potentially leading to account takeover or data theft via Cross-Site Scripting (XSS).
Technical details
A vulnerability exists in DOMPurify's `IN_PLACE` sanitization mode where the library fails to strip event-handler attributes from a root `<form>` element if it is "clobbered" by its descendants. When `DOMPurify.sanitize(root, { IN_PLACE: true })` is called on a detached node, the `_forceRemove` function fails to detach the node because it has no parent, and `_sanitizeAttributes` returns early without inspecting attributes if `_isClobbered` returns true. An attacker can trigger this by placing a descendant element with a `name` attribute that shadows internal properties like `nodeName` or `setAttribute`. This allows malicious event handlers (e.g., `onmouseover`) on the root element to persist and execute. The issue is fixed in version 3.4.6 by hardening checks for clobbered nodes and ensuring attributes are stripped even on parent-less roots.
Affected products
- cure53 DOMPurify < 3.4.6
Timeline
- 2026-05-26: patched: Version 3.4.6 released
- 2026-05-26: advisory: GitHub Security Advisory GHSA-r47g-fvhr-h676 published
- 2026-07-14: disclosed: CVE-2026-49459 published to NVD