GHSA-mmhx-hmjr-r674

Suggest an improvement
Source
https://github.com/advisories/GHSA-mmhx-hmjr-r674
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-mmhx-hmjr-r674/GHSA-mmhx-hmjr-r674.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-mmhx-hmjr-r674
Aliases
Published
2024-09-16T20:34:26Z
Modified
2024-09-16T22:37:33Z
Severity
  • 7.0 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L CVSS Calculator
  • 8.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
DOMPurify allows tampering by prototype pollution
Details

It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also possible to use Prototype Pollution to weaken the depth check.

This renders dompurify unable to avoid XSS attack.

Fixed by https://github.com/cure53/DOMPurify/commit/1e520262bf4c66b5efda49e2316d6d1246ca7b21 (3.x branch) and https://github.com/cure53/DOMPurify/commit/26e1d69ca7f769f5c558619d644d90dd8bf26ebc (2.x branch).

References

Affected packages

npm / dompurify

Package

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.5.4

npm / dompurify

Package

Affected ranges

Type
SEMVER
Events
Introduced
3.0.0
Fixed
3.1.3