VDB
Sign up
HIGH7.0

GHSA-mmhx-hmjr-r674

DOMPurify allows tampering by prototype pollution

Quick fix

GHSA-mmhx-hmjr-r674 — dompurify: upgrade to the fixed version with the command below.

npm install dompurify@2.5.4

Details

It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also possible to use Prototype Pollution to weaken the depth check.

This renders dompurify unable to avoid XSS attack.

Fixed by https://github.com/cure53/DOMPurify/commit/1e520262bf4c66b5efda49e2316d6d1246ca7b21 (3.x branch) and https://github.com/cure53/DOMPurify/commit/26e1d69ca7f769f5c558619d644d90dd8bf26ebc (2.x branch).

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/dompurify
Introduced in: 0Fixed in: 2.5.4
Fixnpm install dompurify@2.5.4
npm/dompurify
Introduced in: 3.0.0Fixed in: 3.1.3
Fixnpm install dompurify@3.1.3

References