CVE-2025-48050: High severity DOMPurify DOMPurify vulnerability
image-size is vulnerable to a Denial-of-Service vulnerability when processing specially crafted images.
Other sources
In DOMPurify through 3.2.5 before 6bc6d60, scripts/server.js does not ensure that a pathname is located under the current working directory. NOTE: the Supplier disputes the significance of this report because the "Uncontrolled data used in path expression" occurs "in a development helper script which starts a local web server if needed and must be manually started."
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48050?
CVE-2025-48050 is a moderate severity vulnerability due to improper pathname handling in DOMPurify.
How do I fix CVE-2025-48050?
To fix CVE-2025-48050, upgrade to DOMPurify version 3.2.5 or later where the issue is resolved.
What are the potential impacts of CVE-2025-48050?
The potential impacts of CVE-2025-48050 include unauthorized access to sensitive file paths and potential execution of unintended scripts.
Which versions of DOMPurify are affected by CVE-2025-48050?
CVE-2025-48050 affects DOMPurify versions before 3.2.5.
Is there a workaround for CVE-2025-48050 if I cannot upgrade?
A temporary workaround for CVE-2025-48050 includes validating user input to ensure pathnames remain within the expected directory.