CyberRota Analysis
AI-GeneratedDOMPurify versions prior to 3.3.2 are vulnerable to a URI validation bypass that can be exploited when the ADD_ATTR predicate function is used in EXTRA_ELEMENT_HANDLING.attributeCheck. This flaw allows attackers to bypass URI-safe validation, potentially leading to the execution of unsafe protocols such as javascript: and enabling DOM-based cross-site scripting (XSS) attacks. Developers and security teams using affected versions of DOMPurify should prioritize upgrading to mitigate the risk of XSS vulnerabilities in their applications.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck. Attackers can supply a predicate that accepts specific attribute and tag combinations to bypass URI-safe validation, allowing unsafe protocols like javascript: to survive sanitization and execute as DOM-based XSS when the link is activated.
Related CVEs
Other vulnerabilities affecting the same vendor(s)