GHSA-mmhx-hmjr-r674
Suggest an improvement- Source
- https://github.com/advisories/GHSA-mmhx-hmjr-r674
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-mmhx-hmjr-r674/GHSA-mmhx-hmjr-r674.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/GHSA-mmhx-hmjr-r674
- Aliases
- Related
- Published
- 2024-09-16T20:34:26Z
- Modified
- 2024-09-16T22:37:33Z
- Severity
-
- 7.0 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L CVSS Calculator
- 8.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- DOMPurify allows tampering by prototype pollution
- Details
-
It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also possible to use Prototype Pollution to weaken the depth check.
This renders dompurify unable to avoid XSS attack.
Fixed by https://github.com/cure53/DOMPurify/commit/1e520262bf4c66b5efda49e2316d6d1246ca7b21 (3.x branch) and https://github.com/cure53/DOMPurify/commit/26e1d69ca7f769f5c558619d644d90dd8bf26ebc (2.x branch).
- Database specific
{ "nvd_published_at": "2024-09-16T19:16:11Z", "cwe_ids": [ "CWE-1321", "CWE-1333" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2024-09-16T20:34:26Z" }- References
-
- https://github.com/cure53/DOMPurify/security/advisories/GHSA-mmhx-hmjr-r674
- https://nvd.nist.gov/vuln/detail/CVE-2024-45801
- https://github.com/cure53/DOMPurify/commit/1e520262bf4c66b5efda49e2316d6d1246ca7b21
- https://github.com/cure53/DOMPurify/commit/26e1d69ca7f769f5c558619d644d90dd8bf26ebc
- https://github.com/cure53/DOMPurify
Affected packages
npm / dompurify
Package
- Name
- dompurify
- View open source insights on deps.dev
- Purl
- pkg:npm/dompurify
npm / dompurify
Package
- Name
- dompurify
- View open source insights on deps.dev
- Purl
- pkg:npm/dompurify