GHSA-mjjq-c88q-qhr6: 
JavaScript vulnerability analysis and mitigation

A critical Cross-Site Scripting (XSS) vulnerability was identified in DOMPurify versions prior to 2.0.7. The vulnerability was discovered and reviewed on August 31, 2020, published to the GitHub Advisory Database on September 3, 2020, and last updated on January 9, 2023. This security issue affects the npm package dompurify, which is a popular HTML sanitization library (GitHub Advisory).

The vulnerability allows attackers to bypass DOMPurify's sanitization mechanisms through Mutation XSS (mXSS). The issue is tracked as GHSA-mjjq-c88q-qhr6 and is classified under CWE-79 (Cross-Site Scripting). The severity of this vulnerability has been assessed as Critical (GitHub Advisory).

When exploited, this vulnerability enables attackers to execute arbitrary JavaScript code in a victim's browser, potentially leading to complete compromise of the client-side security (GitHub Advisory).

The vulnerability affects all versions of DOMPurify below 2.0.7. The issue was discovered by security researcher @masatokinugawa who identified several mXSS vectors that could be exploited (DOMPurify Release).

Users are strongly recommended to upgrade to DOMPurify version 2.0.7 or later, which contains the fix for this vulnerability. The patch addresses several mXSS vectors and includes a fix for a minor crash affecting MSIE11 (DOMPurify Release).