Skip to content
OpenAdvisories

Package · npm

dompurify

33 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.1
    CVE-2024-48910 Public exploit

    DOMPurify vulnerable to tampering by prototype polution

    DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability is fixed in 2.4.2.

    cure53 DOMPurify cacti dompurify Debian Ubuntu npm
  • Critical 10.0
    CVE-2024-47875 Public exploit

    DOMPurify nesting-based mXSS

    DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3.

    cure53 DOMPurify cacti argo-workflows Debian Ubuntu Wolfi npm
  • Critical —
    GHSA-mjjq-c88q-qhr6

    Cross-Site Scripting in dompurify

    Versions of `dompurify` prior to 2.0.7 are vulnerable to Cross-Site Scripting (XSS). It is possible to bypass the package sanitization through Mutation XSS, which may allow an attacker to execute arbitrary JavaScript in a victim's browser. ## Recommendation U…

    dompurify npm