SB20260928329 - Multiple vulnerabilities in DOMPurify

Description

This security bulletin contains information about 2 vulnerabilities.

1) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code in the victim page origin.

The vulnerability exists due to improper neutralization of input during web page generation in DOMPurify IN_PLACE sanitization when processing attacker-supplied markup with a node-removing afterSanitizeElements or afterSanitizeAttributes hook. A remote attacker can supply crafted markup containing an event handler in a descendant of a removed non-root element to execute arbitrary code in the victim page origin.

2) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote attacker to execute arbitrary script.

The vulnerability exists due to improper neutralization of rawtext text content in the DOMPurify IN_PLACE return path when serializing and reparsing a force-removed rawtext root in plain HTML context. A remote attacker can provide a crafted rawtext node to execute arbitrary script.

Moving the returned node with appendChild alone does not trigger the payload.

Remediation

Install update from vendor's website.

References

• https://github.com/cure53/DOMPurify/security/advisories/GHSA-p98j-92pf-mc4p
• https://github.com/cure53/DOMPurify/security/advisories/GHSA-6688-9rhm-gjv2