DOMPurify Open Redirect vulnerability

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2019-25155 · ADVISORY
• cure53/DOMPurify#337 · WEB
• cure53/DOMPurify commit 7601c33 · WEB
• cure53/DOMPurify · PACKAGE
• cure53/DOMPurify · WEB
• cure53/DOMPurify#337 · Patch

dompurify のその他の脆弱性

• CVE-2026-66010中 6.1DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOM_ELEMENT_HANDLING.tagNameCheck, al…
• CVE-2026-65914中 6.1DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML…
• CVE-2026-65913中 6.1DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering…
• CVE-2026-65912中 6.1DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate function via EXTRA_ELEMENT_HA…
• CVE-2026-65911中 6.1In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_E…