Vulnerability Description
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also possible to use Prototype Pollution to weaken the depth check. This renders dompurify unable to avoid cross site scripting (XSS) attacks. This issue has been addressed in versions 2.5.4 and 3.1.3 of DOMPurify. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cure53 | Dompurify | < 2.5.4 |
Related Weaknesses (CWE)
References
- https://github.com/cure53/DOMPurify/commit/1e520262bf4c66b5efda49e2316d6d1246ca7Patch
- https://github.com/cure53/DOMPurify/commit/26e1d69ca7f769f5c558619d644d90dd8bf26Patch
- https://github.com/cure53/DOMPurify/security/advisories/GHSA-mmhx-hmjr-r674Third Party Advisory
FAQ
What is CVE-2024-45801?
CVE-2024-45801 is a vulnerability with a CVSS score of 7.3 (HIGH). DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking add...
How severe is CVE-2024-45801?
CVE-2024-45801 has been rated HIGH with a CVSS base score of 7.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-45801?
Check the references section above for vendor advisories and patch information. Affected products include: Cure53 Dompurify.