DOMPurify 3.4.17 patches flaw letting event handlers fire after parent nodes are removed

A high severity vulnerability in the dompurify npm package allows attackers to bypass sanitization controls. The flaw affects versions up to and including 3.4.16 and has been resolved in version 3.4.17.

What happened

The vulnerability stems from an incomplete fix in version 3.4.16 for a previous issue identified as GHSA-p98j-92pf-mc4p. According to the GitHub advisory GHSA-mrv2-3pqr-j5jr, the prior patch only handled cases where a hook removed the specific node it was processing. If an IN_PLACE hook removed a different node, such as the current node's parent or an unvisited sibling, the security logic failed.

The library’s documentation states that nodes detached from the tree are treated as removed and their subtrees are neutralized inline. This prevents event handlers, like an img onload attribute, from firing after the sanitize function completes. However, this guarantee does not hold when the detached node is not the hook’s own node.

In these scenarios, the internal function _handleHookDetachedNode checks only if the current node lost its parent. When a hook removes the parent node or an ancestor, the current node still appears to have a parent. Consequently, the function returns false and does not neutralize the subtree. The removed portion of the document becomes unreachable by the walker and is not added to the DOMPurify.removed list.

Because the post-walk pass does not see the detached subtree, any event handlers within it remain active. An img tag with an onerror attribute that was already loading can fire after sanitize returns. This behavior applies to all five element and attribute hooks in the library.

Why it matters

This flaw undermines the core security promise of DOMPurify for applications using IN_PLACE mode. Developers relying on the library to sanitize user-generated content may assume that all dangerous attributes are stripped or neutralized. The ability for event handlers to fire after sanitization completes allows for potential cross-site scripting attacks.

The vulnerability affects not just the latest version at the time of disclosure but also earlier versions, including 3.4.15, 3.4.12, and 2.5.8. The issue was tested using jsdom for the matrix and Chromium via Playwright to confirm the event firing. The specific code path involves src/purify.ts line 2134 in the source and dist/purify.cjs.js line 2009 in version 3.4.16.

Our take on the response

• Update dompurify to version 3.4.17 or later immediately.
• Review custom hooks for logic that removes parent or sibling nodes.
• Audit applications for reliance on IN_PLACE mode sanitization guarantees.
• Verify that event handlers do not persist after sanitization in test environments.

What defenders should look for

Teams should monitor for unexpected script execution or event firing in sanitized content containers. Check application logs for anomalies where user input results in active event handlers despite sanitization. Look for patterns where parent or sibling nodes are manipulated by custom hooks. Verify that the library version matches the patched release. Inspect network traffic for requests triggered by onerror or onload attributes that should have been neutralized. Ensure that security testing covers edge cases in node removal logic.

What to do and how to stay safe: dompurify

• Check your dependency tree for dompurify versions 3.4.16 or earlier.
• Upgrade to version 3.4.17 once the vendor provides the update.
• Review custom sanitization hooks for logic that detaches parent nodes.
• Monitor production logs for unexpected event handler executions.

Step-by-step guide: Vulnerability Management Myths That Waste Your Time and Budget

General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of dompurify are affected by this vulnerability?

Versions 3.4.16 and earlier, including 3.4.15, 3.4.12, and 2.5.8, are affected.

Is there a CVE ID assigned to this vulnerability?

No CVE ID has been assigned to this specific vulnerability according to the advisory.

How can I fix the issue?

Update the dompurify npm package to version 3.4.17 or later.