DOMPurify allows tampering by prototype pollution
Date: 2024-09
Affected: npm/dompurify, npm/dompurify
Attack vector: xss
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2024-45801
CWE: CWE-1321
CWE-1333
CVSS: 7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L)

It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also possible to use Prototype Pollution to weaken the depth check. This renders dompurify unable to avoid XSS attack. Fixed by https://github.com/cure53/DOMPurify/commit/1e520262bf4c66b5efda49e2316d6d1246ca7b21 (3.x branch) and https://github.com/cure53/DOMPurify/commit/26e1d69ca7f769f5c558619d644d90dd8bf26ebc (2.x branch).


Mitigations:

Architectural layers (MAESTRO):