CyberRota Analysis
AI-GeneratedDOMPurify versions prior to 3.4.5 are vulnerable to a cross-site scripting (XSS) attack due to improper handling of unsanitized markup within the `<selectedcontent>` tag, which can allow attackers to reintroduce XSS payloads after sanitization. This vulnerability poses a high risk for web applications that rely on DOMPurify for sanitizing user-generated content. Developers and security teams using affected versions should prioritize upgrading to 3.4.5 to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. In 3.4.4, DOMPurify allowed selectedcontent by default, allowing browsers to re-clone an XSS payload after sanitization so that unsanitized markup inside <selectedcontent> is returned. This issue is fixed in version 3.4.5.
Related CVEs
Other vulnerabilities affecting the same vendor(s)