Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| dompurify | npm | <= 3.3.1 | 3.3.2 |
Miggo AIRoot Cause AnalysisThe vulnerability is a prototype pollution issue in DOMPurify. The description clearly states that the problem occurs when USE_PROFILES is enabled, which leads to ALLOWED_ATTR being created as a plain array. This makes it vulnerable to prototype pollution of the Array.prototype.
By analyzing the commits leading to the patched version 3.3.2, I identified the exact commit that fixes this issue. The commit c361baa18dbdcb3344a41110f4c48ad85bf48f80 contains the fix.
The key change is in src/purify.ts, inside the createDOMPurify function. The line ALLOWED_ATTR = []; is replaced with ALLOWED_ATTR = create(null);. This change is the direct mitigation for the described vulnerability. By creating a null-prototype object, the ALLOWED_ATTR list is no longer affected by modifications to Array.prototype, effectively closing the prototype pollution vector.
Therefore, the createDOMPurify function is the vulnerable function, as it is responsible for the insecure initialization of ALLOWED_ATTR.
createDOMPurifysrc/purify.ts