Critical severity9.1NVD Advisory· Published Oct 31, 2024· Updated Jun 17, 2026

CVE-2024-48910

Description

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability is fixed in 2.4.2.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
dompurifynpm	< 2.4.2	2.4.2

Affected products

Cure53/Dompurify2 versions
cpe:2.3:a:cure53:dompurify:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:cure53:dompurify:*:*:*:*:*:*:*:*range: <2.4.2
- (no CPE)range: < 2.4.2
ghsa-coords
pkg:npm/dompurify
Range: < 2.4.2

Patches

Vulnerability mechanics

References

github.com/cure53/DOMPurify/commit/d1dd0374caef2b4c56c3bd09fe1988c3479166dcnvdPatchWEB
github.com/advisories/GHSA-p3vf-v8qc-cwcrghsaADVISORY
github.com/cure53/DOMPurify/security/advisories/GHSA-p3vf-v8qc-cwcrnvdVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2024-48910ghsaADVISORY
lists.debian.org/debian-lts-announce/2025/02/msg00010.htmlnvdWEB

News mentions

No linked articles in our index yet.

cvss	0.591
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000