CyberRota Analysis
AI-GeneratedDOMPurify versions prior to 3.4.6 are vulnerable to a cross-site scripting (XSS) attack due to improper handling of same-origin foreign-realm DOM nodes during sanitization, allowing executable markup to bypass security checks. This vulnerability can lead to the execution of malicious scripts in web applications that utilize DOMPurify for sanitizing user-generated content. Developers and security teams using affected versions should prioritize upgrading to version 3.4.6 or later to mitigate potential XSS risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(node, { IN_PLACE: true }) accepted same-origin foreign-realm DOM nodes while follow-on checks used parent-realm constructors, causing instanceof checks for forms, named node maps, document fragments, and elements to fail and skip clobber, template-content, and shadow-DOM sanitization branches so executable markup could survive. This issue is fixed in version 3.4.6.
Related CVEs
Other vulnerabilities affecting the same vendor(s)