Description
DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS.
Remediation
References
Related Vulnerabilities
Grafana Improper Authentication Vulnerability (CVE-2018-15727)
WordPress Plugin GiveWP-Donation and Fundraising Platform Cross-Site Scripting (2.23.2)
WordPress Resource Management Errors Vulnerability (CVE-2014-5265)
Jboss EAP Improper Input Validation Vulnerability (CVE-2014-0034)
Pega Infinity Improper Restriction of XML External Entity Reference Vulnerability (CVE-2023-50168)