DOMPurify Flaws Enable XSS Bypass Through ADD_ATTR and Prototype Pollution

Two newly disclosed flaws in DOMPurify can let attackers bypass the library’s sanitization logic and inject malicious attributes or unsafe URLs into supposedly cleaned HTML. One issue, tracked as GHSA-CJMM-F4JC-QW8R, affects deployments that use a predicate function with the ADD_ATTR configuration. If that predicate approves URI-bearing attributes such as href or src, DOMPurify can skip later mandatory safety checks, including protocol validation, allowing dangerous values such as javascript:, vbscript:, or data: to pass through and potentially trigger DOM-based cross-site scripting.

A second flaw, GHSA-CJ63-JHHR-WCXV, stems from prototype pollution when the USE_PROFILES option is enabled. In vulnerable versions, DOMPurify initializes ALLOWED_ATTR as a standard JavaScript array, allowing inherited properties from Array.prototype to influence attribute validation. An attacker able to pollute Array.prototype with entries such as onclick can cause DOMPurify to treat malicious event-handler attributes as explicitly allowed, creating another path to XSS. Together, the disclosures show that applications relying on DOMPurify may remain exposed if they use dynamic attribute approval or operate in environments where prototype pollution is possible.