DOMPurify vulnerable to tampering by prototype polution

KRITISCH 9.8CVE-2024-48910 · GHSA-p3vf-v8qc-cwcr · Published 31/10/2024 · updated 17/06/2026

Kurz gesagt

CVE-2024-48910 ist eine Schwachstelle (KRITISCH (CVSS 9.8)) in dompurify (cure53), dompurify.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.2%, höher als bei 66.9% aller Schwachstellen.
Abhilfe: auf 2.4.2 oder neuer aktualisieren.

Package	Affected versions	Patched versions
dompurify cure53	`< 2.4.2`	`2.4.2`
dompurify npm	`< 2.4.2`	`2.4.2`

Description

dompurify was vulnerable to prototype pollution

Fixed by https://github.com/cure53/DOMPurify/commit/d1dd0374caef2b4c56c3bd09fe1988c3479166dc

NVD description

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability is fixed in 2.4.2.

References

cure53/DOMPurify security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2024-48910 · ADVISORY
cure53/DOMPurify commit d1dd037 · WEB
cure53/DOMPurify · PACKAGE
lists.debian.org/debian-lts-announce/2025/02/msg00010.html · WEB

Weitere Schwachstellen in dompurify

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

dompurify

cure53

< 2.4.2

2.4.2

dompurify

npm

< 2.4.2

2.4.2

Description

NVD description

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability is fixed in 2.4.2.

Weitere Schwachstellen in dompurify

Alle anzeigen →