Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
32 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
dompurify was vulnerable to prototype pollution Fixed by https://github.com/cure53/DOMPurify/commit/d1dd0374caef2b4c56c3bd09fe1988c3479166dc
Recommended action: Upgrade to 2.4.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
DOMpurify was vulnerable to nesting-based mXSS fixed by 0ef5e537 (2.x) and merge 943 Backporter should be aware of GHSA-mmhx-hmjr-r674 (CVE-2024-45801) when cherry-picking POC is avaible under test
Recommended action: Upgrade to 3.1.3 or 2.5.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also possible to use Prototype Pollution to weaken the depth check. This renders dompurify unable to avoid XSS attack. Fixed by https://github.com/cure53/DOMPurify/commit/1e520262bf4c66b5efda49e2316d6d1246ca7b21 (3.x branch) and https://github.com/cure53/DOMPurify/commit/26e1d69ca7f769f5c558619d644d90dd8bf26ebc (2.x branch).
Recommended action: Upgrade to 3.1.3 or 2.5.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
DOMPurify before 1.0.11 allows reverse tabnabbing in demos/hooks-target-blank-demo.html because links lack a 'rel="noopener noreferrer"' attribute.
Recommended action: Upgrade to 1.0.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as demonstrated by nesting of FORM elements.
Recommended action: Upgrade to 2.0.17 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Versions of dompurify prior to 2.0.7 are vulnerable to Cross-Site Scripting (XSS). It is possible to bypass the package sanitization through Mutation XSS, which may allow an attacker to execute arbitrary JavaScript in a victim's browser. Recommendation Upgrade to version 2.0.7 or later.
Recommended action: Upgrade to 2.0.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Versions of dompurify prior to 2.0.3 are vulnerable to Cross-Site Scripting (XSS). The package has an XSS filter bypass due to Mutation XSS in both Chrome and Safari through a combination of <svg/<math elements and </p/</br. An example payload is: <svg</p<style<a id="</style<img src=1 onerror=alert(1)". This allows attackers to bypass the XSS protection and execute arbitrary JavaScript in a victim's browser. Recommendation Upgrade to version 2.0.3 or later. You may also disallow <svg and <math through dompurify configurations:
Recommended action: Upgrade to 2.0.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.