Insecure functionality In node-dompurify
Description
DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 debian 12 | - | ||
 rpm rhel10 | - | - | |
rpm rhel10 | - | - | |
rpm rhel8 | - | - | |
debian 13 | - | ||
 npm | 3.4.11 | ||
debian 14 | 3.4.12+dfsg-1 | ||
rpm rhel10 | - | - | |
rpm rhel9 | - | - | |
rpm rhel10 | - | - |
Aliases
1. 2. 3. 4. 5. 6. 7.
References
1. 2. 3. 4.