Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| dompurify | npm | < 3.4.7 | 3.4.7 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the DOMPurify.sanitize function, which is responsible for cleaning up HTML content. The issue arises when hooks, specifically uponSanitizeElement and uponSanitizeAttribute, are used. These hooks are designed to allow developers to customize the sanitization process. However, the sanitize function passes the internal configuration objects (ALLOWED_TAGS and ALLOWED_ATTR) to these hooks by reference, not by value. A malicious or improperly written hook can modify these objects, for example, by adding 'script' to the list of allowed tags. Because the configuration is not cloned for each sanitization process when hooks are involved, this modification becomes permanent for the lifetime of the DOMPurify instance. Any subsequent call to sanitize, even without the hook, will use the polluted configuration, allowing potentially malicious content like script tags to bypass the sanitizer. The patch addresses this by cloning the configuration objects at the beginning of the sanitize function if any relevant hooks are registered, thus isolating the configuration for each call and preventing the pollution of the global defaults.
DOMPurify.sanitizesrc/purify.ts