Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability exists in DOMPurify's sanitization process when handling template expressions within <template> elements, specifically when the SAFE_FOR_TEMPLATES option is enabled along with RETURN_DOM or IN_PLACE. The root cause is that the _scrubTemplateExpressions function in src/purify.ts does not recursively check the content of <template> elements. The NodeIterator it uses is designed to skip <template> content according to the DOM specification. An attacker can exploit this by splitting a malicious template expression (e.g., ${alert(1)}) across two or more adjacent elements inside a <template> tag. The _sanitizeElements function inspects each text node individually and finds no malicious content, as each part of the split expression is harmless on its own. Later, when a downstream template engine processes the sanitized output, it may normalize the content of the <template> element, merging the separate text nodes back into the original malicious expression, leading to its evaluation and a potential Cross-Site Scripting (XSS) attack. The main DOMPurify.sanitize function is the entry point that, when called with the vulnerable configuration, triggers this flawed process.
_scrubTemplateExpressionssrc/purify.ts
_sanitizeElementssrc/purify.ts
DOMPurify.sanitizesrc/purify.ts
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| dompurify | npm | >= 3.0.0, <= 3.4.7 | 3.4.8 |