CVE-2024-45801: Tampering by prototype polution in DOMPurify
DOMPurify could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution flaw in depth check. By adding or modifying properties of Object.prototype using a __proto__ or constructor payload, an attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the system.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45801?
CVE-2024-45801 is considered a high severity vulnerability due to its potential for XSS exploitation.
How do I fix CVE-2024-45801?
To fix CVE-2024-45801, update DOMPurify to version 3.1.3 or later, or to version 2.5.4 if using an earlier version.
What is the impact of CVE-2024-45801?
CVE-2024-45801 allows attackers to bypass depth checking, leading to potential XSS attacks.
Who is affected by CVE-2024-45801?
CVE-2024-45801 affects users of DOMPurify versions between 3.0.0 and 3.1.3 and those using versions up to 2.5.4.
What is DOMPurify in relation to CVE-2024-45801?
DOMPurify is an XSS sanitizer for HTML, MathML, and SVG that is affected by CVE-2024-45801 due to a vulnerability in its nesting depth mechanisms.