alex-acero-security/cve-2024-48910-pocProof of concept demonstrating prototype pollution in DOMPurify leading to client-side XSS, with a demo of the attack chain.
This is a proof of concept for CVE-2024-48910. This is a vulnerability that was present in DOMPurify, an XSS sanitizer for HTML, SVG, and MathML. This version of DOMPurify is vulnerable to prototype pollution, where an atatcker can inject properties into any JS object's base prototype, causing all subsequent objects in an application to inherit this malicious behavior. This demo shows how this can be leveraged to achieve client-side XSS.
