CVE-2024-48910: DOMPurify vulnerable to tampering by prototype polution
DOMPurify could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a prototype pollution. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
Other sources
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability is fixed in 2.4.2.
— NVD
dompurify was vulnerable to prototype pollution
Fixed by https://github.com/cure53/DOMPurify/commit/d1dd0374caef2b4c56c3bd09fe1988c3479166dc
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/dompurifyto a version that resolves this vulnerability.Fixed in 2.4.2 - Upgrade
Upgrade
DOMPurifyto a version that resolves this vulnerability.Fixed in 2.4.2Patch d1dd0374caef2b4c56c3bd09fe1988c3479166dc
Event History
Frequently Asked Questions
What is the severity of CVE-2024-48910?
CVE-2024-48910 is a high severity vulnerability that allows a remote authenticated attacker to execute arbitrary code due to prototype pollution.
How do I fix CVE-2024-48910?
To fix CVE-2024-48910, upgrade DOMPurify to version 2.4.2 or later.
Who is affected by CVE-2024-48910?
CVE-2024-48910 affects applications that use the DOMPurify package versions prior to 2.4.2.
What type of vulnerability is CVE-2024-48910?
CVE-2024-48910 is a prototype pollution vulnerability that can lead to remote code execution.
Can CVE-2024-48910 be exploited remotely?
Yes, CVE-2024-48910 can be exploited remotely by an authenticated attacker.