CyberRota Analysis
AI-GeneratedDOMPurify versions prior to 3.4.12 are vulnerable due to a failure in executing the afterSanitizeElements hook for custom elements, which allows certain attributes to bypass security policies. This flaw can enable attackers to retain sensitive attributes on custom elements, potentially leading to second-order cross-site scripting (XSS) vulnerabilities when these attributes are re-injected into innerHTML sinks. Developers and security teams using affected versions should prioritize updates to mitigate the risk of XSS attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOM_ELEMENT_HANDLING.tagNameCheck, allowing attributes to bypass application security policies. Attackers can preserve sensitive attributes on custom elements that later re-inject them into innerHTML sinks, creating second-order XSS gadgets.
Related CVEs
Other vulnerabilities affecting the same vendor(s)