VDB
Sign up
MEDIUM6.1

GHSA-v2wj-7wpq-c8vv

DOMPurify contains a Cross-site Scripting vulnerability

Quick fix

GHSA-v2wj-7wpq-c8vv — dompurify: upgrade to the fixed version with the command below.

npm install dompurify@3.3.2

Details

DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in 2.5.9 and 3.3.2, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the `SAFE_FOR_XML` regex. Attackers can include payloads like `</noscript><img src=x onerror=alert(1)>` in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/dompurify
Introduced in: 3.1.3Fixed in: 3.3.2
Fixnpm install dompurify@3.3.2
npm/dompurify
Introduced in: 2.5.3Fixed in: 2.5.9
Fixnpm install dompurify@2.5.9

References