CyberRota Analysis
AI-GeneratedDOMPurify versions prior to 3.4.9 are vulnerable due to improper handling of the Trusted Types policy when the clearConfig() function is invoked, allowing a reused instance to retain potentially unsafe configurations. This flaw can lead to the execution of malicious scripts through TrustedHTML objects, posing a risk to applications that rely on DOMPurify for sanitizing HTML content. Developers and security teams utilizing DOMPurify in their web applications should prioritize updating to the latest version to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied TRUSTED_TYPES_POLICY. A later caller that requests RETURN_TRUSTED_TYPE output receives a TrustedHTML object created by the old (potentially unsafe) policy rather than a clean default, which can lead to script execution at a Trusted Types sink. Passing TRUSTED_TYPES_POLICY: null on the later call also does not clear the retained policy.
Related CVEs
Other vulnerabilities affecting the same vendor(s)