Packages / dompurify / Security

HighVulnerabilityGHSA-mmhx-hmjr-r674CVE-2024-45801Published 16 Sep 2024

DOMPurify allows tampering by prototype pollution

Affected releases · dompurify

  • 3.x3.0.0 – 3.1.2Fixed in 3.1.3
  • 2.x2.0.0 – 2.5.3Fixed in 2.5.4
  • 1.x and older0.4.0 – 1.1.1No fix, no longer updated

On 3.x, the newest line:

npm install dompurify@3.1.3
3.x

  1. Affected

    3.0.0 – 3.1.2

    15 releases

  2. Fixed

    3.1.3 – 3.4.17

    35 releases, latest

2.x

  1. Affected

    2.0.0 – 2.5.3

    57 releases

  2. Fixed

    2.5.4 – 2.5.9

    6 releases

1.x

  1. Affected

    1.0.0 – 1.1.1

    14 releases

0.x

  1. Affected

    0.4.0 – 0.9.0

    29 releases

156 stable releases of dompurify, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for dompurify. It is read in your browser and sent nowhere.

What happens

It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also possible to use Prototype Pollution to weaken the depth check.

This renders dompurify unable to avoid XSS attack.

Fixed by 1e52026 (3.x branch) and 26e1d69 (2.x branch).