Executive brief
DOMPurify is a widely-used JavaScript library that sanitizes HTML to prevent XSS attacks on web pages. When configured for in-place sanitization with custom hooks that remove elements, the library may fail to disable event handlers on child elements that get detached. This allows malicious JavaScript to execute after the sanitization completes, bypassing the protection and compromising the application and its users' data.
Technical details
The vulnerability exists in DOMPurify 3.4.12's _sanitizeElements() function in src/purify.ts:1862-1904. When a beforeSanitizeElements or uponSanitizeElement hook detaches a DOM node, the code returns immediately without calling _neutralizeSubtree(currentNode) to disable event handlers. This leaves descendant resource elements (like img tags) with their attacker-supplied event handlers intact. If the browser has queued a resource event during construction, the handler fires asynchronously after sanitize() returns, even though the detached subtree is not connected to the document and the returned root is clean. The vulnerability requires two non-default conditions: IN_PLACE mode must be enabled and a hook must use the documented element-removal pattern. The issue was patched in version 3.4.13 by calling _neutralizeSubtree() before returning from hook-detachment branches.
Affected products
- Cure53 DOMPurify 3.4.12 and earlier
Timeline
- 2026-08-07: disclosed: GHSA-55q2-fjhq-7xh7 published
- 2026-08-03: patched: Version 3.4.13 released with fix