VDB
DEBIAN-CVE-2024-45801
DEBIAN-CVE-2024-45801
PUBLISHED
CVSS 6.099999904632568 MEDIUM
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also possible to use Prototype Pollution to weaken the depth check. This renders dompurify unable to avoid cross site scripting (XSS) attacks. This issue has been addressed in versions 2.5.4 and 3.1.3 of DOMPurify. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Risk Scores
CVSS 3.1
6.099999904632568
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian:12 | node-dompurify | 0, 2.4.1+dfsg+~2.4.0-1, 2.4.1+dfsg+~2.4.0-2 |
Timeline
- Sep 16, 2024 CVE Published
- Apr 28, 2026 CVE Updated