CyberRota Analysis
AI-GeneratedDOMPurify versions prior to 3.4.11 are vulnerable due to a flaw in the handling of the ALLOWED_ATTR allowlist when using the setConfig() method with an uponSanitizeAttribute hook. This vulnerability allows attackers to manipulate the allowlist, potentially enabling the execution of malicious event handlers through stored cross-site scripting (XSS) attacks. Developers and organizations utilizing DOMPurify for sanitizing untrusted content should prioritize updating to the latest version to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS.
Related CVEs
Other vulnerabilities affecting the same vendor(s)