Description
DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the SAFE_FOR_XML regex. Attackers can include payloads like </noscript><img src=x onerror=alert(1)> in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
cure53 DOMPurify
Default version status: unaffected
3.1.3 to ≤ 3.3.1affected2.5.3 to ≤ 2.5.8affected
References
- https://github.com/cure53/DOMPurify ↗
- https://github.com/cure53/DOMPurify/commit/302b51de22535cc90235472c52e3401bedd46f80 ↗
- https://github.com/cure53/DOMPurify/releases/tag/3.3.2 ↗
- https://fluidattacks.com/advisories/daft ↗
- https://www.vulncheck.com/advisories/dompurify-xss-via-missing-rawtext-elements-in-safe-for-xml ↗