Executive brief
DOMPurify is a widely-used JavaScript library that sanitizes HTML content to prevent malicious code injection. Versions before 2.0.7 contained a flaw allowing attackers to bypass its sanitization through "Mutation XSS" techniques, potentially enabling execution of arbitrary JavaScript in users' browsers when viewing untrusted content.
Technical details
DOMPurify prior to version 2.0.7 is vulnerable to Mutation XSS (mXSS), a variant of cross-site scripting (CWE-79) that exploits how browsers parse and mutate HTML during rendering. The vulnerability allows attackers to craft malicious HTML that passes DOMPurify's sanitization checks but is transformed by the browser into executable JavaScript. Since DOMPurify operates at the DOM level, this mutation can occur after sanitization. The attack vector is network-based (supplying malicious HTML to be sanitized by an application using the vulnerable library), and no authentication is required. Patch 2.0.7, released in October 2020, fixed multiple mXSS vectors identified by researcher Masato Kinugawa.
Affected products
- Cure53 DOMPurify before 2.0.7
Timeline
- 2020-09-03: disclosed
- 2020-10-21: patched: Version 2.0.7 released