Key points
- dompurify versions 3.4.16 and earlier are vulnerable to a high severity issue.
- The fix is available in version 3.4.17.
- The flaw affects how hooks handle detached nodes in IN_PLACE mode.
Developers using the dompurify npm package must update to version 3.4.17 to address a high severity security flaw. Versions 3.4.16 and earlier, including 3.4.15, 3.4.12 and 2.5.8, are affected. The issue allows event handlers to execute after the sanitize function returns. This occurs when custom hooks remove nodes other than the one currently being processed.
In plain English
The dompurify library cleans HTML by removing dangerous code. It uses hooks to let developers customize this process. A previous fix in 3.4.16 only worked if a hook removed the specific node it was handling. If a hook removes a parent node or a sibling node instead, the library fails to clean the rest of that section. Dangerous scripts or event handlers in that section remain active and can run.
The background
According to the GitHub advisory GHSA-mrv2-3pqr-j5jr, the flaw exists in the _handleHookDetachedNode function. The code checks if the current node lost its parent. If a hook removes an ancestor node, the current node still appears to have a parent. The library then skips cleaning that subtree. This affects all five element and attribute hooks. The issue was tested using jsdom and Chromium.
What changes now
Version 3.4.17 patches this vulnerability. Users of the npm package should update their dependencies immediately. The advisory notes that the README documentation about neutralizing subtrees in IN_PLACE mode was inaccurate for cases where detached nodes are not the hook's own node. The new version corrects this behavior to ensure all removed subtrees are properly neutralized.
Who needs to act first
Teams should prioritize updating systems that process untrusted user input. Check for projects using dompurify in production environments first. Roll out the update in a controlled manner to test for compatibility issues. Back up current configurations before applying changes. Monitor logs for any unexpected script executions during the transition. Ensure all environments, including staging and development, are updated to prevent accidental exposure.
What to do and how to stay safe: dompurify
- Audit your project dependencies to identify if you are using a vulnerable version of dompurify.
- Update the package to version 3.4.17 as soon as possible.
- Review any custom hooks in your implementation to ensure they align with the new sanitization behavior.
- Monitor application logs for signs of executed event handlers after the update.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the severity of this vulnerability?
The GitHub advisory rates the severity as high.
Which versions of dompurify are affected?
Versions 3.4.16 and earlier, including 3.4.15, 3.4.12 and 2.5.8, are vulnerable.
Is there a fix available?
Yes, version 3.4.17 patches the issue.
