Prototype Pollution In node-dompurify
Description
DOMPurify allows tampering by prototype pollution It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also possible to use Prototype Pollution to weaken the depth check.
This renders dompurify unable to avoid XSS attack.
Fixed by https://github.com/cure53/DOMPurify/commit/1e520262bf4c66b5efda49e2316d6d1246ca7b21 (3.x branch) and https://github.com/cure53/DOMPurify/commit/26e1d69ca7f769f5c558619d644d90dd8bf26ebc (2.x branch).
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 debian 12 | 2.4.1+dfsg+~2.4.0-2+deb12u1 | ||
 npm | 2.5.4, 3.1.3 | ||
 rpm rhel9 | - | - | |
rpm rhel10 | - | - |
Aliases
1. 2. 3. 4. 5. 6. 7.
References
1. 2. 3.