GHSA-mmhx-hmjr-r674

DOMPurify allows tampering by prototype pollution

Source: GitHub Advisory Database (reviewed) High CVE-2024-45801

Packages

Ecosystem	Package	Affected	Fixed in
npm	dompurify	< 2.5.4	2.5.4
npm	dompurify	>= 3.0.0, < 3.1.3	3.1.3

Details

As written in the advisory (Markdown source, shown as plain text).

It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also possible to use Prototype Pollution to weaken the depth check. This renders dompurify unable to avoid XSS attack. Fixed by https://github.com/cure53/DOMPurify/commit/1e520262bf4c66b5efda49e2316d6d1246ca7b21 (3.x branch) and https://github.com/cure53/DOMPurify/commit/26e1d69ca7f769f5c558619d644d90dd8bf26ebc (2.x branch).

References

External links from the advisory. They lead to third-party sites.

https://github.com/cure53/DOMPurify/security/advisories/GHSA-mmhx-hmjr-r674 web
https://nvd.nist.gov/vuln/detail/CVE-2024-45801 advisory
https://github.com/cure53/DOMPurify/commit/1e520262bf4c66b5efda49e2316d6d1246ca7b21 web
https://github.com/cure53/DOMPurify/commit/26e1d69ca7f769f5c558619d644d90dd8bf26ebc web
https://github.com/cure53/DOMPurify package