Packages / dompurify / Security

HighVulnerabilityGHSA-gx9m-whjm-85jfCVE-2024-47875Published 11 Oct 2024

DOMpurify has a nesting-based mXSS

Affected releases · dompurify

  • 3.x3.0.0 – 3.1.2Fixed in 3.1.3
  • 2.x2.0.0 – 2.4.9Fixed in 2.5.0
  • 1.x and older0.4.0 – 1.1.1No fix, no longer updated

On 3.x, the newest line:

npm install dompurify@3.1.3
3.x

  1. Affected

    3.0.0 – 3.1.2

    15 releases

  2. Fixed

    3.1.3 – 3.4.17

    35 releases, latest

2.x

  1. Affected

    2.0.0 – 2.4.9

    53 releases

  2. Fixed

    2.5.0 – 2.5.9

    10 releases

1.x

  1. Affected

    1.0.0 – 1.1.1

    14 releases

0.x

  1. Affected

    0.4.0 – 0.9.0

    29 releases

156 stable releases of dompurify, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for dompurify. It is read in your browser and sent nowhere.

What happens

DOMpurify was vulnerable to nesting-based mXSS

fixed by 0ef5e537 (2.x) and merge 943

Backporter should be aware of GHSA-mmhx-hmjr-r674 (CVE-2024-45801) when cherry-picking

POC is avaible under test