VDB
EN
MEDIUM 6.1

GHSA-v2wj-7wpq-c8vv

DOMPurify contains a Cross-site Scripting vulnerability

상세

DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in 2.5.9 and 3.3.2, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the `SAFE_FOR_XML` regex. Attackers can include payloads like `</noscript><img src=x onerror=alert(1)>` in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.

이 버전이 영향받나요?

사용 중인 패키지 버전을 입력하면 즉시 평가합니다.

영향 패키지

npm / dompurify
최초 영향 버전: 3.1.3 수정 버전: 3.3.2
수정 npm install dompurify@3.3.2
npm / dompurify
최초 영향 버전: 2.5.3 수정 버전: 2.5.9
수정 npm install dompurify@2.5.9

참고