CyberRota Analysis
AI-GeneratedDOMPurify versions prior to 3.4.0 are vulnerable due to a logic error in the ADD_TAGS function, which allows forbidden tags to bypass the FORBID_TAGS restrictions through short-circuit evaluation. This flaw enables attackers to inject malicious tags into sanitized output, potentially leading to cross-site scripting (XSS) vulnerabilities. Developers and security teams using affected versions should prioritize updating to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions. Attackers can craft input containing tags listed in FORBID_TAGS that are also added via ADD_TAGS function, causing them to be retained in sanitized output.
Related CVEs
Other vulnerabilities affecting the same vendor(s)