GHSA-6688-9rhm-gjv2

DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes

Published

2026-10-05

Modified

2026-10-05

Sources

github-advisory

Summary

## Environment - dompurify 3.4.15 (current npm release); reproduced independently on jsdom 30.0.1 and 29.1.1 (Node.js 20.x / 26.x) - Config: `DOMPurify.sanitize(node, { IN_PLACE: true })` on a Node input; `SAFE_FOR_XML` at its default (`true`) ## Summary The 3.4.9 fix for the IN_PLACE detached-root class added two protections on the IN_PLACE return path: a fail-closed `TypeError` in `_forceRemove` when a node selected for removal cannot be detached, and a `_neutralizeSubtree` pass (`dist/purify.js` line 1336) that strips non-allowlisted **attributes** from removed subtrees. Both miss the rawtext **text-content** form. When the force-removed root is a rawtext element (` `), the payload lives in the node's *text*: the node detaches fine (the `TypeError` guard is not reached), `_neutralizeSubtree` strips nothing (there are no attributes), and the IN_PLACE exit returns the detached, never-sanitized ` ` whose text still carries live markup. Serializing that node and re-parsing it in **plain HTML context** materializes the payload — no foreign-content context required. The same Node input sanitized **without** `IN_PLACE` returns an empty result: the only difference is the IN_PLACE return path handing the killed node back. ## Steps to reproduce ```js const { JSDOM } = require('jsdom'); const createDOMPurify = require('dompurify'); // 3.4.15 const window = new JSDOM('').window; const DOMPurify = createDOMPurify(window); const styleRoot = window.document.createElement('style'); styleRoot.setAttribute('onclick', 'alert(1)'); // attribute payload styleRoot.textContent = ' '; // text payload window.document.body.appendChild(styleRoot); const returned = DOMPurify.sanitize(styleRoot, { IN_PLACE: true }); console.log(returned === styleRoot); // true (same node) console.log(styleRoot.parentNode === null); // true (detached) console.log(styleRoot.outerHTML); // console.log(styleRoot.getAttribute('onclick')); // null (attribute neutralized) console.log(styleRoot.textContent); // ' ' (text survives) // plain HTML reparse (no foreign-content context involved): const probe = window.document.createElement('div'); probe.innerHTML = returned.outerHTML || styleRoot.outerHTML; console.log(probe.querySelectorAll('img').length); // 1 console.log(probe.querySelector('img').getAttribute('onerror')); // "1" ``` Observed on 3.4.15: one node, one call — the `onclick` **attribute** is neutralized while the **text** payload (` `) survives verbatim; serializing and re-parsing the returned node in plain HTML context materializes the `img` with the live `onerror` handler. Contrast on the same Node input without `IN_PLACE`: `RETURN_DOM: true` → ` `; `RETURN_DOM_FRAGMENT: true` → 0 children — the payload is fully sanitized away. The only difference is the IN_PLACE return path. Contrast on the removal trigger: `SAFE_FOR_XML: false` → the node is not removed (detached stays false); plain CSS text → not removed. The removal is gated by the mXSS text probes and happens *specifically because* the serialized node would re-open tags on reparse. ## Root cause `_isUnsafeNode` (`dist/purify.js` 3.4.15, lines 1700–1714) removes nodes whose literal text would re-open tags on reparse — shape (b) in the source comment is "text-only content that already carries the element's OWN end tag", detected by the `LITERAL_TEXT_CLOSE` probe (line 385) alongside the `ELEMENT_MARKUP_PROBE` (line 339) rules. `_forceRemove` (line 1122) records the node in `DOMPurify.removed` (`{element}`) and detaches it. The removal is intentional: the upstream comment states these shapes are removed **because the literal serializer emits them verbatim for the HTML parser to re-open**. The IN_PLACE exit then hands the force-removed root back to the caller —

Affected packages

Remediation: Upgrade to 3.4.16 or later.

References

• https://github.com/advisories/GHSA-6688-9rhm-gjv2