Fluid Attacks Database

Description

Cross-site Scripting in dompurify Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as demonstrated by nesting of FORM elements.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
npm	dompurify	>=0 <2.0.17	2.0.17

Aliases

1. CVE-2020-268702. NVD-2020-268703. OSV-2020-268704. GCVE-2020-268705. lists.debian.org

References

1. https://github.com/cure53/DOMPurify/commit/02724b8eb048dd219d6725b05c3000936f11d62d2. https://github.com/cure53/DOMPurify/compare/2.0.16...2.0.173. https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-268704. https://research.securitum.com/mutation-xss-via-mathml-mutation-dompurify-2-0-17-bypass5. https://www.oracle.com//security-alerts/cpujul2021.html