DOMPurify Cross-Site Scripting Vulnerability in SAFE_FOR_TEMPLATES with RETURN_DOM Mode

A cross-site scripting (XSS) vulnerability exists in DOMPurify versions 1.0.10 prior to 3.4.0. The issue arises because the SAFE_FOR_TEMPLATES option, which is intended to strip '{{...}}' expressions from untrusted HTML, does not function correctly when RETURN_DOM or RETURN_DOM_FRAGMENT modes are enabled. This flaw allows XSS attacks through template-evaluating frameworks such as Vue 2.

Impact

Exploiting this vulnerability allows for cross-site scripting attacks, where an attacker can execute malicious scripts in the context of the user's browser.

Reproduction

To reproduce this vulnerability, use DOMPurify version 3.3.3 with the SAFE_FOR_TEMPLATES option set to true and the RETURN_DOM option enabled. After sanitizing the input, the resulting DOM can be mounted into a Vue 2 application, which will execute the injected script payload.

Remediation

Users can upgrade to DOMPurify version 3.4.0 or later, where this vulnerability has been patched.