VYPR
← All advisories
High severity7.3NVD Advisory· Published Nov 13, 2024· Updated Apr 29, 2026

CVE-2024-21541

CVE-2024-21541

Description

Versions of the package dom-iterator before 1.0.1 are vulnerable to Arbitrary Code Execution due to use of the Function constructor without complete input sanitization. Function generates a new function body and thus care must be given to ensure that the inputs to Function are not attacker-controlled. The risks involved are similar to that of allowing attacker-controlled input to reach eval.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
dom-iteratornpm
< 1.0.11.0.1

Affected products

1

Patches

1
9e0e0fad5a25

Fix for CVE-2024-21541

https://github.com/matthewmueller/dom-iteratorVladimir JankovićDec 17, 2024via ghsa
commit
1 file changed · +1 −1
  • index.js+1 −1 modified
    @@ -267,7 +267,7 @@ Iterator.prototype.compile = function(expr) {
     case 'number':
       return function(node) { return expr == node.nodeType; };
     case 'string':
-      return new Function('node', 'return ' + props(expr, 'node.'));
+      return new Function('node', 'Object.freeze(node); return ' + props(expr, 'node.'));
     case 'function':
       return expr;
     default:

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.