DOMPurify vulnerable to tampering by prototype polution

Mô tả

Tham khảo

• cure53/DOMPurify security advisory · WEB
• nvd.nist.gov/vuln/detail/CVE-2024-48910 · ADVISORY
• cure53/DOMPurify commit d1dd037 · WEB
• cure53/DOMPurify · PACKAGE
• lists.debian.org/debian-lts-announce/2025/02/msg00010.html · WEB

Lỗ hổng khác của dompurify

• CVE-2026-66010TRUNG BÌNH 6.1DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOM_ELEMENT_HANDLING.tagNameCheck, al…
• CVE-2026-65914TRUNG BÌNH 6.1DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML…
• CVE-2026-65913TRUNG BÌNH 6.1DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering…
• CVE-2026-65912TRUNG BÌNH 6.1DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate function via EXTRA_ELEMENT_HA…
• CVE-2026-65911TRUNG BÌNH 6.1In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_E…