CVE-2024-45801

What it actually does

Malicious HTML with crafted nesting bypasses DOMPurify depth checks; Prototype Pollution can further weaken those checks, allowing arbitrary script execution via XSS.

Why it matters to the business

Attackers can execute unauthorized scripts in user browsers, enabling theft of session tokens, account takeover, or unauthorized actions within any application relying on this library.

How an attack unfolds

An attacker supplies specially nested HTML combined with prototype-pollution properties to a DOMPurify instance; the library's sanitization fails, returning executable script that runs in the victim's browser context.

How to fix it

Upgrade cure53/dompurify to a version containing commit 1e520262bf4c66b5efda49e2316d6d1246ca7b21 (3.x) or 26e1d69ca7f769f5c558619d644d90dd8bf26ebc (2.x); replace all direct Git references with the patched commit 10c12610b15875ea09129c35fca28a886857434f or later releases.

How to confirm the fix worked

Confirm the installed DOMPurify version includes one of the listed fix commits; re-run the library against the original bypass test cases and verify that depth-limited and polluted inputs are now rejected.

Typical attack path

1. Identify an application endpoint that processes untrusted HTML through DOMPurify
2. Craft a payload using deep nesting and prototype-pollution keys to evade depth limits
3. Submit the payload via user-controlled input such as comments, rich text, or profile fields
4. Confirm the sanitized output still contains executable script tags or event handlers
5. Leverage the resulting XSS for session hijacking or data exfiltration

How to detect it

Inspect web-application logs and browser telemetry for unexpected script execution or HTML fragments that contain event handlers or script tags after sanitization; correlate with requests to endpoints known to invoke DOMPurify.

What your security team should do

• Immediately replace all instances of DOMPurify with a build containing the referenced fix commits
• Audit downstream packages and rebuild any bundled or vendored copies of the library
• Add automated dependency scanning to detect future unpatched versions of DOMPurify
• Review application inputs that feed DOMPurify and apply additional server-side validation where feasible