VYPR
← All advisories
Medium severity6.4NVD Advisory· Published Sep 26, 2024· Updated Jun 17, 2026

CVE-2024-47075

CVE-2024-47075

Description

LayUI is a native minimalist modular Web UI component library. Versions prior to 2.9.17 have a DOM Clobbering vulnerability that can lead to Cross-site Scripting (XSS) on web pages where attacker-controlled HTML elements (e.g., img tags with unsanitized name attributes) are present. Version 2.9.17 fixes this issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
layuinpm
< 2.9.172.9.17

Affected products

3
  • Layui/Layui2 versions
    cpe:2.3:a:layui:layui:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:layui:layui:*:*:*:*:*:*:*:*range: <2.9.17
    • (no CPE)range: < 2.9.17
  • ghsa-coords
    pkg:npm/layui
    Range: < 2.9.17

Patches

Vulnerability mechanics

References

5

News mentions

0

No linked articles in our index yet.