Packages / dompurify / Security

ModerateVulnerabilityGHSA-63q7-h895-m982CVE-2020-26870Published 18 Dec 2020

Cross-site Scripting in dompurify

Affected releases · dompurify

  • 2.x2.0.0 – 2.0.16Fixed in 2.0.17
  • 1.x and older0.4.0 – 1.1.1No fix, no longer updated

On 2.x, the newest line:

npm install dompurify@2.0.17
3.x

  1. Not affected

    3.0.0 – 3.4.17

    50 releases, latest

2.x

  1. Affected

    2.0.0 – 2.0.16

    17 releases

  2. Fixed

    2.0.17 – 2.5.9

    46 releases

1.x

  1. Affected

    1.0.0 – 1.1.1

    14 releases

0.x

  1. Affected

    0.4.0 – 0.9.0

    29 releases

156 stable releases of dompurify, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for dompurify. It is read in your browser and sent nowhere.

What happens

Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as demonstrated by nesting of FORM elements.