Update dependency dompurify to v3.4.13 [SECURITY] by renovate[bot] · Pull Request #16652 · ohcnetwork/care_fe

renovate · 2026-08-08T18:00:23Z

This PR contains the following updates:

Package	Change	Age	Confidence
dompurify	`3.4.12` → `3.4.13`

DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS

GHSA-55q2-fjhq-7xh7

More information

Details

Summary

During IN_PLACE sanitization, a hook that removes an element can leave that element's detached descendants executable. A descendant image can retain its attacker-provided onload handler and fire after sanitize() returns, even though the returned root is clean and the image remains disconnected from the document.

Details

In DOMPurify 3.4.12, _sanitizeElements() in src/purify.ts:1862-1904 runs the beforeSanitizeElements or uponSanitizeElement hook and returns immediately when the hook detached the current node. The return does not call _neutralizeSubtree(currentNode).

The detached subtree is not added to DOMPurify.removed, so the post-walk IN_PLACE neutralization cannot reach it. If the browser queued a resource event while the application constructed the detached dirty root, a descendant can therefore retain its handler and execute after sanitization.

The hook only rejects the containing element and does not add or approve the event handler. DOMPurify's ordinary removal path de-arms the same queued event; only the hook-detachment early return skips the existing subtree neutralization.

PoC

Load the published dompurify@3.4.12 dist/purify.js before this script in Chromium:

<div id="result">not fired</div>
<script>
const root = document.createElement('div');
root.innerHTML = `
  <footer>
    <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7"
         onload="result.textContent = 'XSS after sanitize'">
  </footer>
  <div>safe</div>`;

DOMPurify.setConfig({
  ALLOWED_TAGS: ['div', '#text', 'footer'],
  IN_PLACE: true
});
DOMPurify.addHook('uponSanitizeElement', node => {
  if (node.tagName === 'FOOTER') node.remove();
});

DOMPurify.sanitize(root);
document.body.append(root);
</script>

sanitize() returns with no handler execution and the returned root contains only the safe div. After the event loop advances, the original image remains disconnected but its retained onload changes the page to XSS after sanitize.

As the claim-matched control, use the same detached input with ALLOWED_TAGS: ['div', '#text'] and no hook. DOMPurify's ordinary removal path removes the original image's handler, the returned root is still <div>safe</div>, and the marker does not fire.

Impact

In an application that uses IN_PLACE with the documented element-removal hook pattern, an attacker who can supply HTML can execute JavaScript in the integrating application's origin after the application sanitizes and renders that content.

The required non-default configuration is IN_PLACE plus a hook that removes a containing element. The hook does not add or approve the event handler, and the dirty root never needs to be connected before sanitization.

Suggested fix

Reuse the existing _neutralizeSubtree(currentNode) helper before returning from both hook-detachment branches in _sanitizeElements(). Add regressions for beforeSanitizeElements and uponSanitizeElement that retain a reference to a descendant resource element and verify that its event handler is removed after the hook detaches its ancestor.

Severity

CVSS Score: 5.1 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

cure53/DOMPurify (dompurify)

`v3.4.13`: DOMPurify 3.4.13

Compare Source

Fixed an issue with hook removal during IN_PLACE sanitization, thanks @koyokr
Fixed an issue with hooks potentially bypassing the clone guard, thanks @AkshayjainG
Fixed an issue with DOM clobbering via ownerDocument during IN_PLACE, thanks @AkshayjainG
Bumped several dependencies where possible

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

cloudflare-workers-and-pages · 2026-08-08T18:01:43Z

Deploying care-preview with Cloudflare Pages

Latest commit:	`d6197ab`
Status:	✅ Deploy successful!
Preview URL:	https://44a6fef9.care-preview-a7w.pages.dev
Branch Preview URL:	https://renovate-npm-dompurify-vulne.care-preview-a7w.pages.dev

View logs

github-actions

Fine, an automated dependency bump fixing a real XSS bug in dompurify (IN_PLACE hook removal). Just a lockfile diff, nothing for me to gripe about. Approved — go merge it before I change my mind.> Generated by Grumpy PR Reviewer for #16652 · auto · 8.79 AIC · ⌖ 2.08 AIC · ⊞ 8.7K

github-actions · 2026-08-08T18:13:33Z

🎭 Playwright Test Results

Status: ✅ Passed
Test Shards: 3

Metric	Count
Total Tests	358
✅ Passed	358
❌ Failed	0
⏭️ Skipped	0

📊 Detailed results are available in the playwright-final-report artifact.

_{Run: #10985}

github-actions

Fine, an automated lockfile bump for a security patch (dompurify 3.4.12 -> 3.4.13, GHSA-55q2-fjhq-7xh7). Only package-lock.json changed, no source touched. Nothing to complain about here — approved, begrudgingly.> Generated by Grumpy PR Reviewer for #16652 · auto · 14.6 AIC · ⌖ 2.07 AIC · ⊞ 8.7K

github-actions

Fine. It's just a package-lock.json bump for dompurify 3.4.12 -> 3.4.13, patching a real XSS CVE (GHSA-55q2-fjhq-7xh7). No source changes, nothing for me to grumble about except that Renovate does more thorough security tracking than half the humans I've worked with. Approved.> Generated by Grumpy PR Reviewer for #16652 · auto · 14.8 AIC · ⌖ 2.08 AIC · ⊞ 8.7K

github-actions

Fine, this one is exactly what it says on the tin: a lockfile bump to dompurify@3.4.13 patching a real XSS advisory (GHSA-55q2-fjhq-7xh7) in IN_PLACE hook handling. No source changes to review, just package-lock.json. Nothing to be grumpy about here — merge it and move on.> Generated by Grumpy PR Reviewer for #16652 · auto · 14.7 AIC · ⌖ 3.16 AIC · ⊞ 8.7K

github-actions

Just a lockfile diff bumping dompurify to 3.4.13 (security patch) and some tailwindcss-oxide-wasm optional deps. Nothing for me to sink my teeth into — no source code changed. Approved, begrudgingly.> Generated by Grumpy PR Reviewer for #16652 · auto · 12.6 AIC · ⌖ 2.09 AIC · ⊞ 8.7K

github-actions

Hmph. Just a lockfile bump patching a real DOMPurify XSS advisory (GHSA-55q2-fjhq-7xh7). No source changes to gripe about, no logic to break. Renovate did its one job correctly for once. Approved.> Generated by Grumpy PR Reviewer for #16652 · auto · 8.88 AIC · ⌖ 2.16 AIC · ⊞ 8.7K

github-actions

Just a lockfile bump for a real dompurify XSS CVE (GHSA-55q2-fjhq-7xh7), plus the usual tailwindcss/oxide-wasm32-wasi cruft npm drags along. Nothing to nitpick here — for once the bot did its one job correctly. Approved, begrudgingly.> Generated by Grumpy PR Reviewer for #16652 · auto · 14.8 AIC · ⌖ 3.88 AIC · ⊞ 8.7K

github-actions

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection results could not be parsed.

Review the workflow run logs for details.

Fine, just a lockfile bump for a real dompurify XSS advisory (GHSA-55q2-fjhq-7xh7). No source changes to whine about. Approved — don't make me look at 63 lines of package-lock again.> Generated by Grumpy PR Reviewer for #16652 · auto · 14.6 AIC · ⌖ 2.13 AIC · ⊞ 8.7K

github-actions

Well, would you look at that — a lockfile-only bump for a legit security advisory (dompurify 3.4.12 → 3.4.13, IN_PLACE hook detachment XSS). No hand-written code to grumble about, versions and integrity hash line up. Approved, begrudgingly.> Generated by Grumpy PR Reviewer for #16652 · auto · 14.7 AIC · ⌖ 2.16 AIC · ⊞ 8.7K

github-actions

Forty years in this business and they wake me up for a lockfile diff. Fine.

package-lock.json bumps dompurify 3.4.12 → 3.4.13, which patches GHSA-55q2-fjhq-7xh7 (detached subtree stays executable after an IN_PLACE hook removal). The entry now actually has resolved and integrity fields, which the 3.4.12 entry was missing — so this is strictly less sketchy than what was there before.

The rest of the diff is just the bundled @tailwindcss/oxide-wasm32-wasi sub-tree being re-materialized by npm. Noise, not a change in behavior. No source files touched, no API surface moved, nothing to nitpick.

Well, this is... fine, I guess. Approved. Do not make a habit of dragging me out of retirement for dependency bumps.> Generated by Grumpy PR Reviewer for #16652 · opus50 · 20.4 AIC · ⌖ 2.86 AIC · ⊞ 8.7K

github-actions

Well. A single lockfile bump of dompurify 3.4.12 -> 3.4.13 to patch GHSA-55q2-fjhq-7xh7, plus some bundled tailwind oxide wasm deps that npm decided to spell out. Nothing here for me to complain about: no logic, no naming crimes, no missing error handling. The integrity hash is present, and the transitive additions are all inBundle optional platform junk, which is exactly what a lockfile refresh looks like.

Begrudgingly: this is fine. Ship it, and go patch the vulnerability before somebody IN_PLACE-hooks your users.> Generated by Grumpy PR Reviewer for #16652 · opus50 · 34.4 AIC · ⌖ 2.16 AIC · ⊞ 8.7K

github-actions

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection results could not be parsed.

Review the workflow run logs for details.

Well. A lockfile bump. Riveting.

One file, one real change: dompurify 3.4.12 -> 3.4.13, patching GHSA-55q2-fjhq-7xh7 (an IN_PLACE hook removal leaving a detached subtree still executable). The resolved URL and integrity hash are now actually present, which is more than could be said before.

The extra @tailwindcss/oxide-wasm32-wasi bundled entries are just npm re-materializing bundled optional deps. Noisy diff, harmless.

No hand-edited lockfile nonsense, no stray version drift, no manifest range change needed. Fine. Approved. Merge it and let me get back to reviewing code written by humans, which is somehow worse.> Generated by Grumpy PR Reviewer for #16652 · opus50 · 38.8 AIC · ⊞ 8.7K

github-actions

Forty years in this business and I get handed a lockfile diff. Fine.

package-lock.json bumps dompurify 3.4.12 → 3.4.13, which patches GHSA-55q2-fjhq-7xh7 (detached subtree stays executable after an IN_PLACE hook removal). Integrity hash and resolved URL are present this time — unlike the previous entry, which somehow had neither. Small mercies.

The extra @tailwindcss/oxide-wasm32-wasi bundled sub-deps are noise from a lockfile re-resolution, all optional + inBundle, so they do not ship to your users. Irritating churn, not a defect.

No hand-written code, no logic, nothing to break. Approved. Now go merge it before someone finds the XSS. 🔥> Generated by Grumpy PR Reviewer for #16652 · opus50 · 20.3 AIC · ⌖ 2.2 AIC · ⊞ 8.7K

github-actions

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection results could not be parsed.

Review the workflow run logs for details.

Forty years in this business and I finally get handed a review where the diff is... a lockfile. Thrilling.

What actually changed: dompurify 3.4.12 -> 3.4.13 (the GHSA-55q2-fjhq-7xh7 IN_PLACE hook-detachment XSS fix), plus a pile of bundled @tailwindcss/oxide-wasm32-wasi transitive entries that npm decided to write out this time. No source code touched, no API surface changed, and the new entry actually has a resolved URL and an integrity hash — which, believe it or not, the old one did not. Progress.

So: no security holes introduced, no performance regressions, no 200-line functions, no variables named x. Nothing for me to be grumpy about, which is itself mildly annoying.

Approved. Merge it and stop making me read JSON.

(One begrudging note for the humans, not a blocker: nobody has run the app against 3.4.13 in this diff. If anything here leans on DOMPurify hooks or IN_PLACE, let CI actually prove it before automerge does its thing.)> Generated by Grumpy PR Reviewer for #16652 · opus50 · 20.6 AIC · ⊞ 8.7K

github-actions

Well. A lockfile-only renovate bump: dompurify 3.4.12 -> 3.4.13 (a patch release, and the entry finally has resolved + integrity again, which the previous one was mysteriously missing), plus some bundled optional wasm deps under @tailwindcss/oxide-wasm32-wasi. No source code changed, no APIs touched, nothing for me to be grumpy about.

If you're feeling paranoid: dompurify is your XSS sanitizer, so an actual npm ci plus a test run before merge would be nice. But I'm not holding up a patch bump over it.

Approved. Don't get used to it. 🔥

Generated by Grumpy PR Reviewer for #16652 · opus50 · 28 AIC · ⌖ 1.77 AIC · ⊞ 9.2K

renovate Bot added the dependencies label Aug 8, 2026

renovate Bot requested review from a team August 8, 2026 18:00

renovate Bot added the dependencies label Aug 8, 2026

github-actions Bot approved these changes Aug 8, 2026

View reviewed changes

renovate Bot force-pushed the renovate/npm-dompurify-vulnerability branch from 124b43a to 6cd19e6 Compare August 10, 2026 08:14