CVE-2019-16728
published 2019-09-24CVE-2019-16728: DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demonstrated by Chrome and Safari.
PriorityP424medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
1.67%
74.4th percentile
DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demonstrated by Chrome and Safari.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cure53 | dompurify | < 2.0.1 | 2.0.1 |
| cure53 | dompurify | >= 0 < 2.0.3 | 2.0.3 |
| debian | debian_linux | — | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Cross-Site Scripting in dompurify
ghsa·2020-08-28
CVE-2019-16728 [MEDIUM] CWE-79 Cross-Site Scripting in dompurify
Cross-Site Scripting in dompurify
Versions of `dompurify` prior to 2.0.3 are vulnerable to Cross-Site Scripting (XSS). The package has an XSS filter bypass due to Mutation XSS in both Chrome and Safari through a combination of ``/`` elements and ``/``. An example payload is: `">`. This allows attackers to bypass the XSS protection and execute arbitrary JavaScript in a victim's browser.
## Recommendation
Upgrade to version 2.0.3 or later. You may also disallow `` and `` through `dompurify` configurations:
```DOMPurify.sanitize(input, {
FORBID_TAGS: ['svg', 'math']
});```
OSV
Cross-Site Scripting in dompurify
osv·2020-08-28
CVE-2019-16728 [MEDIUM] Cross-Site Scripting in dompurify
Cross-Site Scripting in dompurify
Versions of `dompurify` prior to 2.0.3 are vulnerable to Cross-Site Scripting (XSS). The package has an XSS filter bypass due to Mutation XSS in both Chrome and Safari through a combination of ``/`` elements and ``/``. An example payload is: `">`. This allows attackers to bypass the XSS protection and execute arbitrary JavaScript in a victim's browser.
## Recommendation
Upgrade to version 2.0.3 or later. You may also disallow `` and `` through `dompurify` configurations:
```DOMPurify.sanitize(input, {
FORBID_TAGS: ['svg', 'math']
});```
OSV
CVE-2019-16728: DOMPurify before 2
osv·2019-09-24·CVSS 6.1
CVE-2019-16728 [MEDIUM] CVE-2019-16728: DOMPurify before 2
DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demonstrated by Chrome and Safari.
No detection rules found.
No public exploits indexed.
2019-09-24
Published