Packages / dompurify / Security

ModerateVulnerabilityGHSA-chqj-j4fh-rw7mCVE-2019-16728Published 28 Aug 2020

Cross-Site Scripting in dompurify

Affected releases · dompurify

  • 2.x2.0.0 – 2.0.2Fixed in 2.0.3
  • 1.x and older0.4.0 – 1.1.1No fix, no longer updated

On 2.x, the newest line:

npm install dompurify@2.0.3
3.x

  1. Not affected

    3.0.0 – 3.4.17

    50 releases, latest

2.x

  1. Affected

    2.0.0 – 2.0.2

    3 releases

  2. Fixed

    2.0.3 – 2.5.9

    60 releases

1.x

  1. Affected

    1.0.0 – 1.1.1

    14 releases

0.x

  1. Affected

    0.4.0 – 0.9.0

    29 releases

156 stable releases of dompurify, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for dompurify. It is read in your browser and sent nowhere.

What happens

Versions of dompurify prior to 2.0.3 are vulnerable to Cross-Site Scripting (XSS). The package has an XSS filter bypass due to Mutation XSS in both Chrome and Safari through a combination of <svg>/<math> elements and </p>/</br>. An example payload is: <svg></p><style><a id="</style><img src=1 onerror=alert(1)>">. This allows attackers to bypass the XSS protection and execute arbitrary JavaScript in a victim's browser.

Recommendation

Upgrade to version 2.0.3 or later. You may also disallow <svg> and <math> through dompurify configurations:

     FORBID_TAGS: ['svg', 'math']
 });```