CyberRota Analysis
AI-GeneratedDOMPurify versions up to 3.4.5 are vulnerable to improper handling of allowed tags and attributes, allowing malicious payloads to persist through sanitization by exploiting hooks that modify the default allow-lists. This can lead to cross-site scripting (XSS) attacks, as subsequent sanitization calls inherit the expanded defaults. Developers and security teams using affected versions should prioritize upgrading to version 3.4.7 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
DOMPurify before 3.4.7 (affected versions <= 3.4.5) passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttributes when sanitize is called without an explicit cfg.ALLOWED_TAGS / cfg.ALLOWED_ATTR array. A hook that mutates these fields permanently widens the default allow-lists for the lifetime of the DOMPurify instance, so all subsequent default-config sanitize calls inherit the widened defaults and attacker payloads using the poisoned tag/attribute name survive sanitization. removeAllHooks(), clearConfig(), and passing a fresh cfg do not recover the state; only constructing a new DOMPurify instance does.
Related CVEs
Other vulnerabilities affecting the same vendor(s)