CVE-2024-45801
CVE-2024-45801 · Tampering by prototype polution in DOMPurify
This page contains facts from public vulnerability sources. Check the original advisory before updating.
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also possible to use Prototype Pollution to weaken the depth check. This renders dompurify unable to avoid cross site scripting (XSS) attacks. This issue has been addressed in versions 2.5.4 and 3.1.3 of DOMPurify. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS 7.3 · High · EPSS 0.9% · Fix available
- Published
- Updated
Affected products and versions
dompurify
- Versions
- < 2.5.4: Affected
- >=3.0.0, < 3.1.3: Affected
No fix published
node-dompurify Debian:12
- Versions
- 2.4.1+dfsg+~2.4.0-1
- 2.4.1+dfsg+~2.4.0-2
- Affected ranges
- ECOSYSTEM: < 2.4.1+dfsg+~2.4.0-2+deb12u1
Update to 2.4.1+dfsg+~2.4.0-2+deb12u1
dompurify npm
- Affected ranges
- SEMVER: < 2.5.4
Update to 2.5.4
dompurify npm
- Affected ranges
- SEMVER: ≥ 3.0.0, < 3.1.3
Update to 3.1.3
node-dompurify Ubuntu:22.04:LTS
- Versions
- 2.3.0+dfsg-2
- 2.3.3+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-dompurify Ubuntu:24.04:LTS
- Versions
- 2.4.1+dfsg+~2.4.0-1
- 3.0.9+dfsg+~3.0.5-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-dompurify Ubuntu:25.10
- Versions
- 3.1.7+dfsg+~3.0.5-1
- 3.1.7+dfsg+~3.0.5-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-dompurify Ubuntu:26.10
- Versions
- 3.3.3+dfsg-1
- 3.4.2+dfsg-1
- 3.4.5+dfsg-1
- 3.4.12+dfsg-1
- 3.4.13+dfsg-1
- 3.4.13+dfsg-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-dompurify Ubuntu:26.04:LTS
- Versions
- 3.1.7+dfsg+~3.0.5-2
- 3.3.3+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published