DOMPurify EUVD-2026-48276

Two conditions must hold simultaneously for exploitation to succeed. First, the application must invoke DOMPurify with the USE_PROFILES option explicitly set - the vulnerability does not exist in default DOMPurify mode. Second, Array.prototype must be pollutable within the same JavaScript runtime, either through a separate prototype pollution vulnerability in the application stack (e.g., an unsafe lodash merge, qs parser misconfiguration, or similar gadget) or because the runtime is already in a polluted state from another vector. Active user interaction is required to trigger the XSS payload, specifically an action that fires the injected event handler (e.g., clicking on an element with onclick). Authentication and network-level access requirements are not constrained by this vulnerability itself - they depend entirely on how the application exposes the DOMPurify-processed input surface. Exploitation is limited in the common case where USE_PROFILES is not used or where the application stack contains no prototype pollution vectors.

The vendor-assigned CVSS 4.0 score of 5.1 (Medium, vector AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N) reflects network reachability, no required privileges, active user interaction to fire the event handler, and a moderate subsequent-system impact consistent with DOM XSS. The AC:L metric is optimistic given the real-world prerequisite: exploiting this flaw requires a prototype pollution capability to already exist in the same JavaScript runtime, either through a separate vulnerability in the application (e.g., a polluted Object.prototype via lodash merge or qs parser) or a runtime already in a polluted state. This is a non-trivial chaining requirement that the CVSS base score does not penalize. No EPSS data was provided, so probability cannot be quantitatively stated. No CISA KEV listing has been identified, consistent with no confirmed mass exploitation. The public proof-of-concept included in the advisory meaningfully lowers the exploitation bar for attackers who have already identified a suitable prototype pollution gadget in a target application. Real-world priority is elevated for applications that use both USE_PROFILES mode and any library with known prototype pollution exposure, and low for applications using DOMPurify in default mode.

An attacker identifies a prototype pollution gadget in the target application - for example, a vulnerable JSON merge utility or query string parser - and uses attacker-controlled input to set Array.prototype.onclick = true in the victim's browser runtime. When the application subsequently sanitizes attacker-supplied HTML using DOMPurify with USE_PROFILES enabled, the onclick attribute on an injected element such as img survives sanitization; when the victim renders and interacts with the output, the injected handler executes arbitrary JavaScript in their session. A proof-of-concept demonstrating this exact chain is included in GHSA-cj63-jhhr-wcxv.