VYPR
← All advisories
High severityNVD Advisory· Published Sep 16, 2024· Updated Sep 16, 2024

Tampering by prototype polution in DOMPurify

CVE-2024-45801

Description

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also possible to use Prototype Pollution to weaken the depth check. This renders dompurify unable to avoid cross site scripting (XSS) attacks. This issue has been addressed in versions 2.5.4 and 3.1.3 of DOMPurify. All users are advised to upgrade. There are no known workarounds for this vulnerability.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
dompurifynpm
< 2.5.42.5.4
dompurifynpm
>= 3.0.0, < 3.1.33.1.3

Affected products

65

Patches

Vulnerability mechanics

References

5

News mentions

0

No linked articles in our index yet.