Trusted Types Policy Bypass in DOMPurify

Executive Summary

DOMPurify versions before 3.4.9 fail to reset the retained Trusted Types policy when clearConfig() is called. This means a reused DOMPurify instance stays bound to a previously set TRUSTED_TYPES_POLICY. Later calls requesting RETURN_TRUSTED_TYPE output may receive a TrustedHTML object from the old policy instead of a clean default, potentially leading to script execution at a Trusted Types sink.

Useful 0 Not Useful 0

Impact Analysis

If you use DOMPurify across different trust boundaries, an attacker could exploit this to execute malicious scripts in your application. This happens when a reused DOMPurify instance retains an unsafe policy, causing it to generate TrustedHTML objects that bypass security checks. Even setting TRUSTED_TYPES_POLICY to null does not clear the retained policy.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized script execution, potentially violating data integrity and confidentiality requirements in GDPR and HIPAA. If exploited, it may result in data breaches or unauthorized access to sensitive information, undermining compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade DOMPurify to version 3.4.9 or later to address the Trusted Types policy state contamination issue. Review any custom policies or configurations that may have been set in reused DOMPurify instances to ensure they are safe and properly reset.

Useful 0 Not Useful 0