CyberRota Analysis
AI-GeneratedDOMPurify versions prior to 3.4.7 are vulnerable to a cross-site scripting (XSS) attack due to inadequate sanitization of shadow contents within `<template>.content`, potentially allowing malicious markup to execute. This vulnerability poses a risk to applications using DOMPurify for sanitizing HTML, MathML, and SVG, particularly those that clone and insert sanitized templates. Developers and security teams utilizing affected versions should prioritize upgrading to version 3.4.7 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.7, DOMPurify IN_PLACE sanitization could skip shadow contents attached to an element inside <template>.content, allowing attacker-controlled markup such as event handlers, JavaScript URLs, or scripts to survive and execute when an application cloned and inserted the sanitized template. This issue is fixed in version 3.4.7.
Related CVEs
Other vulnerabilities affecting the same vendor(s)