[Vulnerability] cure53/DOMPurify: XSS (Cross-Site Scripting) via event handler firing after sanitization

[github-actions]

Potential Security Vulnerability Detected

Repository: cure53/DOMPurify
Commit: 2c8ca25
Author: Cure53
Date: 2026-08-01T12:14:42Z

Commit Message

fix: addressed a possible issue with IN_PLACE hook-usage (#1557)

Pull Request

PR: #1557 - fix: addressed a possible issue with IN_PLACE hook-usage
Labels: None

Description:
See above

Analysis

Vulnerability Type: XSS (Cross-Site Scripting) via event handler firing after sanitization
Severity: High

Description

When DOMPurify is used in IN_PLACE mode and a beforeSanitizeElements/uponSanitizeElement hook detaches a node (e.g., via node.remove()), the detached subtree was not neutralized. If that subtree contained elements with queued resource-event handlers (e.g., an <img> with onload that started loading when the caller built the live tree), those handlers could fire in page scope after sanitize() returns, even though the handlers never appeared in the returned sanitized tree. The fix neutralizes (strips non-allowlisted attributes from) hook-detached subtrees on the IN_PLACE path before returning.

Affected Code

if (currentNode !== root && getParentNode(currentNode) === null) {
  return true;
}

Proof of Concept

// Exploit using IN_PLACE mode with a hook that removes a node
const div = document.createElement('div');
div.innerHTML = '<img src="x" onload="alert(document.cookie)">';
// The img starts loading immediately since it's in a live document context
DOMPurify.addHook('beforeSanitizeElements', function(node) {
  if (node.tagName === 'IMG') node.remove(); // detaches node, but onload already queued
});
DOMPurify.sanitize(div, { IN_PLACE: true });
// Before patch: onload fires after sanitize returns because detached img
// retains its onload attribute and the load event was already queued
// After patch: _neutralizeSubtree strips onload from the detached img

---

This issue was automatically created by Vulnerability Spoiler Alert.
Detected at: 2026-08-01T13:13:26.231Z