CVE-2024-47875: DOMPurify nesting-based mXSS
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3.
Other sources
DOMpurify was vulnerable to nesting-based mXSS
fixed by 0ef5e537 (2.x) and merge 943
Backporter should be aware of GHSA-mmhx-hmjr-r674 (CVE-2024-45801) when cherry-picking
POC is avaible under test
— GitHub
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47875?
The severity of CVE-2024-47875 is classified as high due to its potential for cross-site scripting attacks.
How do I fix CVE-2024-47875?
To fix CVE-2024-47875, update DOMPurify to version 2.5.0 or 3.1.3 or later.
What type of vulnerability is CVE-2024-47875?
CVE-2024-47875 is a nesting-based mXSS vulnerability affecting the DOMPurify library.
What versions of DOMPurify are affected by CVE-2024-47875?
CVE-2024-47875 affects DOMPurify versions between 3.0.0 and 3.1.2, as well as versions below 2.5.0.
Is CVE-2024-47875 a critical vulnerability?
Yes, CVE-2024-47875 is considered a critical vulnerability due to the risk of executing malicious scripts.