CyberRota Analysis
AI-GeneratedDOMPurify versions up to 3.4.6 are vulnerable to a cross-site scripting (XSS) flaw in IN_PLACE mode, where attacker-controlled nodeNames can be manipulated in live non-form nodes. This allows attackers to inject malicious scripts that execute when the sanitized DOM is inserted into a document, potentially compromising user data and session integrity. Developers and security teams using DOMPurify should prioritize updating to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements, causing scripts to execute when the sanitized tree is inserted into a live document.
Related CVEs
Other vulnerabilities affecting the same vendor(s)