DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the SAFE_FOR_XML regex. Attackers can include payloads like </noscript><img src=x onerror=alert(1)> in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
Passive
Minimal interaction
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 2
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Cure53 Dompurify
cpe:2.3:a:cure53:dompurify:*:*:*:*:*:*:*:*
|
2.5.3
|
<= 2.5.8
|
|
Cure53 Dompurify
cpe:2.3:a:cure53:dompurify:*:*:*:*:*:*:*:*
|
3.1.3
|
<= 3.3.1
|
References 6
https://github.com/cure53/DOMPurify
disclosure@vulncheck.com
https://github.com/cure53/DOMPurify/commit/fca0a938b4261ddc9c0293a289935a9029c0…
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/dompurify-xss-via-missing-rawtext-elements…
disclosure@vulncheck.com
https://fluidattacks.com/advisories/daft
help@fluidattacks.com
https://github.com/cure53/DOMPurify/commit/302b51de22535cc90235472c52e3401bedd4…
help@fluidattacks.com
https://github.com/cure53/DOMPurify/releases/tag/3.3.2
help@fluidattacks.com