Vulnerability Description
Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as demonstrated by nesting of FORM elements.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cure53 | Dompurify | < 2.0.17 |
| Debian | Debian Linux | 9.0 |
| Microsoft | Visual Studio 2017 | 15.9 |
| Microsoft | Visual Studio 2019 | 16.0 |
| Oracle | Application Express | < 21.1.0.00.01 |
Related Weaknesses (CWE)
References
- https://github.com/cure53/DOMPurify/commit/02724b8eb048dd219d6725b05c3000936f11dPatchThird Party Advisory
- https://github.com/cure53/DOMPurify/compare/2.0.16...2.0.17PatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/10/msg00029.htmlMailing ListThird Party Advisory
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-2687PatchVendor Advisory
- https://research.securitum.com/mutation-xss-via-mathml-mutation-dompurify-2-0-17ExploitThird Party Advisory
- https://www.oracle.com//security-alerts/cpujul2021.htmlPatchThird Party Advisory
- https://github.com/cure53/DOMPurify/commit/02724b8eb048dd219d6725b05c3000936f11dPatchThird Party Advisory
- https://github.com/cure53/DOMPurify/compare/2.0.16...2.0.17PatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/10/msg00029.htmlMailing ListThird Party Advisory
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-2687PatchVendor Advisory
- https://research.securitum.com/mutation-xss-via-mathml-mutation-dompurify-2-0-17ExploitThird Party Advisory
- https://www.oracle.com//security-alerts/cpujul2021.htmlPatchThird Party Advisory
FAQ
What is CVE-2020-26870?
CVE-2020-26870 is a vulnerability with a CVSS score of 6.1 (MEDIUM). Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, a...
How severe is CVE-2020-26870?
CVE-2020-26870 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-26870?
Check the references section above for vendor advisories and patch information. Affected products include: Cure53 Dompurify, Debian Debian Linux, Microsoft Visual Studio 2017, Microsoft Visual Studio 2019, Oracle Application Express.