CyberRota Analysis
AI-GeneratedDOMPurify versions up to 3.3.3 are vulnerable when processing DOM elements in IN_PLACE mode from different windows or realms, such as iframes, leading to inadequate sanitization of potentially malicious content. This flaw allows attackers to inject XSS payloads into applications that rely on DOMPurify for sanitizing user-generated content. Developers and security teams using DOMPurify in environments where cross-origin elements are handled should prioritize remediation to mitigate the risk of XSS attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument). A cross-realm instanceof check in the private _isNode() function returns false for foreign-realm nodes, causing DOMPurify to stringify the element (yielding '[object HTMLDivElement]'), silently reset IN_PLACE to false, and return the unsanitized element unchanged with any XSS payloads intact.
Related CVEs
Other vulnerabilities affecting the same vendor(s)