Executive brief
DOMPurify is a widely-used HTML sanitizer library that removes potentially malicious content from user-supplied HTML. When configured with both the ADD_TAGS and FORBID_TAGS settings simultaneously, a logic flaw causes forbidden tags to be incorrectly allowed through due to short-circuit evaluation in the condition checking. An attacker who can inject HTML into a page using a vulnerable application could bypass tag restrictions and potentially inject malicious scripts or other harmful content.
Technical details
The vulnerability exists in src/purify.ts lines 1117–1123, where tag handling uses the condition: !(tagCheck(tagName)) && (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]). When tagCheck(tagName) returns true, the negation makes the entire left side false, short-circuiting the AND operator and preventing FORBID_TAGS[tagName] from being evaluated. This means tags added via the tagCheck function bypass the forbidden-tags list entirely. The root cause is a logic ordering issue: the code checks the user-defined tagCheck callback before consulting FORBID_TAGS, whereas on the attribute side (line 1214), FORBID_ATTR is checked first with an explicit continue statement. Attack preconditions require an application to configure DOMPurify with both ADD_TAGS as a function and FORBID_TAGS simultaneously. An attacker injecting HTML into such an application could craft tag payloads that pass the tagCheck function and bypass FORBID_TAGS restrictions. The fix is to reorder the check: evaluate FORBID_TAGS first and deny the tag before checking tagCheck. This issue was patched in version 3.4.0.
Affected products
- Cure53 DOMPurify <= 3.3.3
Timeline
- 2026-04-16: disclosed: Advisory GHSA-39q2-94rc-95cp published
- 2026-04-16: patched: Fixed in version 3.4.0