GHSA-CJ63-JHHR-WCXV

When USE_PROFILES is enabled, DOMPurify rebuilds ALLOWED_ATTR as a plain array before populating it with the requested allowlists. Because the sanitizer still looks up attributes via ALLOWED_ATTR[lcName], any Array.prototype property that is polluted also counts as an allowlisted attribute. An attacker who can set Array.prototype.onclick = true (or a runtime already subject to prototype pollution) can thus force DOMPurify to keep event handlers such as onclick even when they are normally forbidden. The provided PoC sanitizes <img onclick=...> with USE_PROFILES and adds the sanitized output to the DOM; the polluted prototype allows the event handler to survive and execute, turning what should be a blocklist into a silent XSS vector.

Credits

Identified by Cantina’s Apex (https://www.cantina.security).

Prototype pollution makes DOMPurify accept dangerous event handler attributes, which bypasses the sanitizer and results in DOM-based XSS once the sanitized markup is rendered.

Kodem intelligence

1. What is GHSA-CJ63-JHHR-WCXV? GHSA-CJ63-JHHR-WCXV is a medium-severity security vulnerability in dompurify (npm), affecting versions <= 3.3.1. It is fixed in 3.3.2.
2. Which versions of dompurify are affected by GHSA-CJ63-JHHR-WCXV? dompurify (npm) versions <= 3.3.1 is affected.
3. Is there a fix for GHSA-CJ63-JHHR-WCXV? Yes. GHSA-CJ63-JHHR-WCXV is fixed in 3.3.2. Upgrade to this version or later.
4. Is GHSA-CJ63-JHHR-WCXV exploitable, and should I be worried? Whether GHSA-CJ63-JHHR-WCXV is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether GHSA-CJ63-JHHR-WCXV is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix GHSA-CJ63-JHHR-WCXV? Upgrade dompurify to 3.3.2 or later.