CVE-2024-48910

DOMPurify vulnerable to tampering by prototype polution

CVSS 9.1 CRITICALEPSS 1.2%CWE-1321

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability is fixed in 2.4.2.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

cure53 · DOMPurify

public PoCs found — 2

githubgithub.com/Mitchellzhou1/CVE-2024-48910-PoC★ 2 githubgithub.com/Alex-Acero-Security/CVE-2024-48910-POC★ 0

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/cure53/DOMPurify/commit/d1dd0374caef2b4c56c3bd09fe1988c3479166dc https://github.com/cure53/DOMPurify/security/advisories/GHSA-p3vf-v8qc-cwcr https://lists.debian.org/debian-lts-announce/2025/02/msg00010.html