| Package | Affected versions | Patched versions |
|---|---|---|
| dompurify | < 2.0.1 | 2.0.1 |
| dompurify | < 2.0.3 | 2.0.3 |
Versions of dompurify prior to 2.0.3 are vulnerable to Cross-Site Scripting (XSS). The package has an XSS filter bypass due to Mutation XSS in both Chrome and Safari through a combination of <svg>/<math> elements and </p>/</br>. An example payload is: <svg></p><style><a id="</style><img src=1 onerror=alert(1)>">. This allows attackers to bypass the XSS protection and execute arbitrary JavaScript in a victim's browser.
Upgrade to version 2.0.3 or later. You may also disallow <svg> and <math> through dompurify configurations:
FORBID_TAGS: ['svg', 'math']
});```
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free