CVE-2020-26870: 
vulnerability analysis and mitigation

CVE-2020-26870 affects Cure53 DOMPurify versions before 2.0.17. The vulnerability is a mutation XSS (Cross-Site Scripting) issue that occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as demonstrated by nesting of FORM elements (NVD, CVE). The vulnerability was discovered and disclosed in October 2020.

The vulnerability exploits a behavior where the HTML parser's serialize-parse roundtrip doesn't guarantee returning the original DOM tree. Specifically, it involves namespace confusion between HTML and MathML when nesting FORM elements. The vulnerability has a CVSS v3.1 Base Score of 6.1 MEDIUM (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) (NVD).

When successfully exploited, the vulnerability allows an attacker to execute cross-site scripting attacks through mutation of the DOM tree. This can lead to unauthorized access to sensitive browser data and potential execution of malicious scripts in the context of the vulnerable web application (Securitum).

The vulnerability is exploitable through specially crafted HTML content that includes nested FORM elements and MathML namespace manipulation. A working proof-of-concept exploit has been publicly documented that demonstrates how the namespace can change from HTML to MathML during the parsing process (Securitum).

The vulnerability has been fixed in DOMPurify version 2.0.17. Users are strongly advised to upgrade to this version or later. For Debian systems, a security update (DLA-2419-1) has been released for the dompurify.js package (Debian). Microsoft has also released patches for affected Visual Studio versions (MSRC).