CVE-2024-45801CWE-1333

Tampering by prototype polution in DOMPurify

High · published September 16, 2024

CVSS v3.1
7.3
EPSS
1%
Percentile
59.1
In the wild
Unconfirmed
What it is

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also possible to use Prototype Pollution to weaken the depth check. This renders dompurify unable to avoid cross site scripting (XSS) attacks. This issue has been addressed in versions 2.5.4 and 3.1.3 of DOMPurify. All users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00894 · 59.1th percentile
Weakness
CWE-1333 · Inefficient Regular Expression Complexity
Published
2024-09-16T18:25Z
EPSS history
Timeline
  • 16 SEP 18:25Z
    Tampering by prototype polution in DOMPurify
    cvelistv5