Cure53🔓

@rauschma@fosstodon.org @evilpie@hachyderm.io Here, for example: https://github.com/WICG/declarative-partial-updates/blob/main/fragment-include-explainer.md Leading to possible attack vectors like this: <?marker name="x">

@joern@threatactor.club then DOMFartify must bring em back 🚀

CTFs hopefully being the primary usecase 🫠

We built a small project to inject Trusted Types enforcing sanitizer use for all HTML sinks. Without changing any of the insecure code. https://github.com/cure53/DOMFortify Maybe it is useful for someone, especially when having to maintain an older site with too many DOMXSS sinks to fix manually.

We did not expect that back in 2014 🥹

DOMPurify 3.4.1 is out with lots of small improvements.

Among them, a better test suite, a small fuzzer, several fixes and hardenings, and as usually we hope all went well 😅

https://github.com/cure53/DOMPurify/releases/tag/3.4.1

We're already seeing a spike in AI-generated PRs making the ecosystem much more secure.

Words cannot describe how grateful we are for all the contributions.

To all the OSS projects getting swamped by AI tickets right now...

IT IS TOTALLY YOUR OWN FAULT.

The easy fix is to write better code.
You are welcome, this advice was free.

*ducks*

In anticipation of possibly upcoming waves of OSS bugs as well maybe increasing amounts of real attacks, we have been busy hardening DOMPurify.

Look at those shiny badges and improvements, LOOK OMG 😱

https://github.com/cure53/dompurify?tab=readme-ov-file#dompurify

Work in progress of course, but lots got done this week 💪🏻

@datenkeller And if you don't, then Roko's Basilisk will get you and teach you some manners soon...

Version 3.4.0 of DOMPurify was released today, addressing a large number of issues reported by LLMs and real people alike.

Thanks to all who contributed.

https://github.com/cure53/DOMPurify/releases/tag/3.4.0

We hope everything went smoothly and that no one was overlooked in the release notes.

@bontchev @GossiTheDog Agreed. Current recommendation from our end: Keep calm, find and fix bugs, make the world a bit safer one bug at a time... And ignore the hype train, but keep an open eye on how real and measurable things develop. Just what we did before.

@agowa338 Cyber security is an insanely complex beast with some parts being technical, some being human, some being regulatory, etc., and well, finding bugs is one small component. Emphasis on small. We have not really been great at cyber security in the past, and improvements are needed all across the board. We won't be great at it tomorrow because magic. Having one component potentially improve is, especially given how speculative the current situation is, is nothing to really worry about. Rather the contrary. Time will tell, some processes might change, and that is likely all that will happen for a long time. Most humans in cyber security will very likely notice very little impact for now. Can this all go sideways? Yes, of course. Is it time to say that cyber security is over? I don't think so. At all.

@Oytis It's quite likely that he won't be.

We know who Angine de Poitrine really is.

@buherator Might also just be physics, having a spine and flipping the bird in zero gravity could be really hard.

Here's everybody's space heroes having a great time with DJT.

https://edition.cnn.com/2026/04/07/science/video/donald-trump-call-artemis-ii-hnk-digvid

🤨 😅

https://blog.trailofbits.com/2026/03/31/how-we-made-trail-of-bits-ai-native-so-far/

@ctxkyo Thanks 🙏

Does anyone have a contact at pwn.ai?

We would kinda like to have a conversation with them...

https://blog.rice.is/post/doom-over-dns/

DOMPurify 2.5.9 and DOMPurify 3.3.2 were released today in a rush to fix a security issue caused by jsdom's faulty tag parsing.

A total of four people reported the exacty same bug within a window of three days.

One did so via email, thank you. One did so via private security advisory, thank you too.

One however simply published a ticket for everyone to see, the other one just dropped a CVE on us without a working fix release. Thanks for nothing.

https://github.com/cure53/DOMPurify/releases/tag/3.3.2

https://github.com/cure53/DOMPurify/releases/tag/2.5.9

We have slightly updated the publicly available contract templates for NDA, MSA and DPA. File format is ODT as usual.

Feel free to, just as before, use them as you see it fit for your own purposes 😄

https://github.com/cure53/Contracts

DOMPurify 3.3.0 is out. You can now configure which tags can have which attributes much more easily.

https://github.com/cure53/DOMPurify/releases/tag/3.3.0

Thanks again to everyone who contributed to and supported the project. ❤️