DOMPurify vulnerable to tampering by prototype polution

概要

参考情報

• cure53/DOMPurify security advisory · WEB
• nvd.nist.gov/vuln/detail/CVE-2024-48910 · ADVISORY
• cure53/DOMPurify commit d1dd037 · WEB
• cure53/DOMPurify · PACKAGE
• lists.debian.org/debian-lts-announce/2025/02/msg00010.html · WEB

dompurify のその他の脆弱性

• CVE-2026-66010中 6.1DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOM_ELEMENT_HANDLING.tagNameCheck, al…
• CVE-2026-65914中 6.1DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML…
• CVE-2026-65913中 6.1DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering…
• CVE-2026-65912中 6.1DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate function via EXTRA_ELEMENT_HA…
• CVE-2026-65911中 6.1In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_E…