Executive brief
DOMPurify, a widely used library for cleaning up malicious code from web pages, contains a security flaw when using its 'profiles' feature. An attacker can exploit this to bypass security filters and inject malicious scripts into a website. This could lead to unauthorized actions being performed in a user's browser, such as stealing session information or redirecting users to malicious sites.
Technical details
A prototype pollution vulnerability exists in DOMPurify when the USE_PROFILES configuration is enabled. In this mode, the library rebuilds its internal attribute allowlist (ALLOWED_ATTR) as a plain array but continues to perform lookups using bracket notation. If an attacker can pollute Array.prototype (e.g., setting Array.prototype.onclick = true), the sanitizer will incorrectly identify dangerous event handlers as allowlisted attributes. This bypass allows malicious event handlers to survive the sanitization process, leading to DOM-based Cross-Site Scripting (XSS) when the output is rendered. The issue is fixed in version 3.3.2.
Affected products
- cure53 DOMPurify < 3.3.2
Timeline
- 2026-04-01: advisory: GitHub Security Advisory published
- 2026-07-23: disclosed: NVD publication date