DOMPurify vulnerable to tampering by prototype polution

CRITICAL 9.8CVE-2024-48910 · GHSA-p3vf-v8qc-cwcr · Published 31/10/2024 · updated 17/06/2026

In short

CVE-2024-48910 is a CRITICAL (CVSS 9.8) vulnerability affecting dompurify (cure53), dompurify.
Chance of exploitation in the next 30 days (EPSS): 1.2%, higher than 66.9% of all vulnerabilities.
Fix: update to 2.4.2 or later.

Package	Affected versions	Patched versions
dompurify cure53	`< 2.4.2`	`2.4.2`
dompurify npm	`< 2.4.2`	`2.4.2`

Description

dompurify was vulnerable to prototype pollution

Fixed by https://github.com/cure53/DOMPurify/commit/d1dd0374caef2b4c56c3bd09fe1988c3479166dc

NVD description

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability is fixed in 2.4.2.

References

cure53/DOMPurify security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2024-48910 · ADVISORY
cure53/DOMPurify commit d1dd037 · WEB
cure53/DOMPurify · PACKAGE
lists.debian.org/debian-lts-announce/2025/02/msg00010.html · WEB

More vulnerabilities in dompurify

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

dompurify

cure53

< 2.4.2

2.4.2

dompurify

npm

< 2.4.2

2.4.2

Description

NVD description

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability is fixed in 2.4.2.

More vulnerabilities in dompurify

See all →