CVE-2020-26870
published 2020-10-07CVE-2020-26870: Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a…
PriorityP429medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
4.88%
91.1th percentile
Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as demonstrated by nesting of FORM elements.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ammonia_project | ammonia | < 3.1.0 | 3.1.0 |
| ammonia_project | ammonia | >= 0 < 2.1.3 | 2.1.3 |
| ammonia_project | ammonia | >= 3.0.0 < 3.1.0 | 3.1.0 |
| cure53 | dompurify | < 2.0.17 | 2.0.17 |
| cure53 | dompurify | >= 0 < 2.0.17 | 2.0.17 |
| debian | debian_linux | — | — |
| debian | rust-ammonia | < rust-ammonia 3.1.2-1 (bookworm) | rust-ammonia 3.1.2-1 (bookworm) |
| github.com | gotify_server | >= 0 < 2.2.3 | 2.2.3 |
| marktext | marktext | <= 0.16.2 | — |
| microsoft | visual_studio_2017 | — | — |
| microsoft | visual_studio_2019 | — | — |
| microsoft | visual_studio_2019 | — | — |
| microsoft | visual_studio_2019 | — | — |
| microsoft | visual_studio_2019 | — | — |
| msrc | microsoft_visual_studio_2017_version_15.9 | — | — |
| msrc | microsoft_visual_studio_2019_version_16.0 | — | — |
| msrc | microsoft_visual_studio_2019_version_16.4 | — | — |
| msrc | microsoft_visual_studio_2019_version_16.7 | — | — |
| msrc | microsoft_visual_studio_2019_version_16.8 | — | — |
| oracle | application_express | < 21.1.0.00.01 | 21.1.0.00.01 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
ghsa6.1MEDIUM
osv6.1MEDIUM
vendor_msrc7.0HIGH
vendor_debian6.1MEDIUM
vendor_oracle6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Retail Applications Risk Matrix: Internal Operations (DOMPurify) — CVE-2020-26870
vendor_oracle·2024-01-15·CVSS 6.1
CVE-2020-26870 [MEDIUM] Oracle Oracle Retail Applications Risk Matrix: Internal Operations (DOMPurify) — CVE-2020-26870
Oracle Oracle Retail Applications Risk Matrix: Internal Operations (DOMPurify) vulnerability
CVE: CVE-2020-26870
CVSS: 6.1
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2024 (JAN 2024)
Oracle
Oracle Oracle Database Server Risk Matrix: Oracle Application Express Application Builder (DOMPurify) — CVE-2020-26870
vendor_oracle·2021-07-15·CVSS 5.4
CVE-2020-26870 [MEDIUM] Oracle Oracle Database Server Risk Matrix: Oracle Application Express Application Builder (DOMPurify) — CVE-2020-26870
Oracle Oracle Database Server Risk Matrix: Oracle Application Express Application Builder (DOMPurify) vulnerability
CVE: CVE-2020-26870
CVSS: 5.4
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpujul2021 (JUL 2021)
Microsoft
Visual Studio Remote Code Execution Vulnerability
vendor_msrc·2021-01-12·CVSS 7.0
CVE-2020-26870 [MEDIUM] Visual Studio Remote Code Execution Vulnerability
Visual Studio Remote Code Execution Vulnerability
FAQ: Why is a CVE that was issued by the MITRE Corporation in the Security Update Guide?
CVE-2020-26870 documents a vulnerability in Cure53 DOMPurify which is open source software used by Visual Studio. The documented Visual Studio updates incorporate the updates in Cure53 DOMPurify which address the vulnerability.
Visual Studio: Visual Studio
MITRE Corporation: MITRE Corporation
Customer Action Required: Yes
Impact: Remote Code Execution
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely;DOS:N/A
Remediation: Release Notes
Reference: http://aka.ms/vs/15/release/latest
Reference: https://my.visualstudio.com/Downloads?q=Visual Studio 2019
Debian
CVE-2021-38193: rust-ammonia - An issue was discovered in the ammonia crate before 3.1.0 for Rust. XSS can occu...
vendor_debian·2021·CVSS 6.1
CVE-2021-38193 [MEDIUM] CVE-2021-38193: rust-ammonia - An issue was discovered in the ammonia crate before 3.1.0 for Rust. XSS can occu...
An issue was discovered in the ammonia crate before 3.1.0 for Rust. XSS can occur because the parsing differences for HTML, SVG, and MathML are mishandled, a similar issue to CVE-2020-26870.
Scope: local
bookworm: resolved (fixed in 3.1.2-1)
forky: resolved (fixed in 3.1.2-1)
sid: resolved (fixed in 3.1.2-1)
trixie: resolved (fixed in 3.1.2-1)
OSV
Reflected XSS in Gotify's /docs via import of outdated Swagger UI
osv·2023-01-10·CVSS 6.1
[MEDIUM] Reflected XSS in Gotify's /docs via import of outdated Swagger UI
Reflected XSS in Gotify's /docs via import of outdated Swagger UI
### Impact
Gotify exposes an outdated instance of the [Swagger UI](https://swagger.io/tools/swagger-ui/) API documentation frontend at `/docs` which is susceptible to reflected XSS attacks when loading external Swagger config files.
Specifically, the DOMPurify version included with this version of Swagger UI is vulnerable to a [rendering XSS](https://www.vidocsecurity.com/blog/hacking-swagger-ui-from-xss-to-account-takeovers/) incorporating the mutation payload detailed in [CVE-2020-26870](https://research.securitum.com/mutation-xss-via-mathml-mutation-dompurify-2-0-17-bypass/) which was patched in 2021. This is further tracked in the GitHub Advisory Database as GHSA-QRMM-W75W-3WPX.
An attacker can execute arbitrary Java
GHSA
Reflected XSS in Gotify's /docs via import of outdated Swagger UI
ghsa·2023-01-10·CVSS 6.1
[MEDIUM] CWE-79 Reflected XSS in Gotify's /docs via import of outdated Swagger UI
Reflected XSS in Gotify's /docs via import of outdated Swagger UI
### Impact
Gotify exposes an outdated instance of the [Swagger UI](https://swagger.io/tools/swagger-ui/) API documentation frontend at `/docs` which is susceptible to reflected XSS attacks when loading external Swagger config files.
Specifically, the DOMPurify version included with this version of Swagger UI is vulnerable to a [rendering XSS](https://www.vidocsecurity.com/blog/hacking-swagger-ui-from-xss-to-account-takeovers/) incorporating the mutation payload detailed in [CVE-2020-26870](https://research.securitum.com/mutation-xss-via-mathml-mutation-dompurify-2-0-17-bypass/) which was patched in 2021. This is further tracked in the GitHub Advisory Database as GHSA-QRMM-W75W-3WPX.
An attacker can execute arbitrary Java
GHSA
GHSA-q367-49gp-hvp2: Mutation XSS exists in Mark Text through 0
ghsa_unreviewed·2022-05-24·CVSS 6.1
CVE-2020-27176 [MEDIUM] CWE-79 GHSA-q367-49gp-hvp2: Mutation XSS exists in Mark Text through 0
Mutation XSS exists in Mark Text through 0.16.2 that leads to Remote Code Execution. NOTE: this might be considered a duplicate of CVE-2020-26870; however, it can also be considered an issue in the design of the "source code mode" feature, which parses HTML even though HTML support is not one of the primary advertised roles of the product.
GHSA
Server side request forgery in SwaggerUI
ghsa·2021-12-09
[MEDIUM] CWE-918 Server side request forgery in SwaggerUI
Server side request forgery in SwaggerUI
SwaggerUI supports displaying remote OpenAPI definitions through the `?url` parameter. This enables robust demonstration capabilities on sites like `petstore.swagger.io`, `editor.swagger.io`, and similar sites, where users often want to see what their OpenAPI definitions would look like rendered.
However, this functionality may pose a risk for users who host their own SwaggerUI instances. In particular, including remote OpenAPI definitions opens a vector for phishing attacks by abusing the trusted names/domains of self-hosted instances.
An example scenario abusing this functionality could take the following form:
- `https://example.com/api-docs` hosts a version of SwaggerUI with `?url=` query parameter enabled.
- Users will trust the domain `http
OSV
Server side request forgery in SwaggerUI
osv·2021-12-09
[MEDIUM] Server side request forgery in SwaggerUI
Server side request forgery in SwaggerUI
SwaggerUI supports displaying remote OpenAPI definitions through the `?url` parameter. This enables robust demonstration capabilities on sites like `petstore.swagger.io`, `editor.swagger.io`, and similar sites, where users often want to see what their OpenAPI definitions would look like rendered.
However, this functionality may pose a risk for users who host their own SwaggerUI instances. In particular, including remote OpenAPI definitions opens a vector for phishing attacks by abusing the trusted names/domains of self-hosted instances.
An example scenario abusing this functionality could take the following form:
- `https://example.com/api-docs` hosts a version of SwaggerUI with `?url=` query parameter enabled.
- Users will trust the domain `http
OSV
Cross-site Scripting in ammonia
osv·2021-08-25·CVSS 6.1
CVE-2021-38193 [MEDIUM] Cross-site Scripting in ammonia
Cross-site Scripting in ammonia
An issue was discovered in the ammonia crate before 3.1.0 for Rust. XSS can occur because the parsing differences for HTML, SVG, and MathML are mishandled, a similar issue to CVE-2020-26870.
GHSA
Cross-site Scripting in ammonia
ghsa·2021-08-25·CVSS 6.1
CVE-2021-38193 [MEDIUM] CWE-79 Cross-site Scripting in ammonia
Cross-site Scripting in ammonia
An issue was discovered in the ammonia crate before 3.1.0 for Rust. XSS can occur because the parsing differences for HTML, SVG, and MathML are mishandled, a similar issue to CVE-2020-26870.
OSV
CVE-2021-38193: An issue was discovered in the ammonia crate before 3
osv·2021-08-08·CVSS 6.1
CVE-2021-38193 [MEDIUM] CVE-2021-38193: An issue was discovered in the ammonia crate before 3
An issue was discovered in the ammonia crate before 3.1.0 for Rust. XSS can occur because the parsing differences for HTML, SVG, and MathML are mishandled, a similar issue to CVE-2020-26870.
GHSA
Cross-site Scripting in dompurify
ghsa·2020-12-18
CVE-2020-26870 [MEDIUM] CWE-79 Cross-site Scripting in dompurify
Cross-site Scripting in dompurify
Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as demonstrated by nesting of FORM elements.
OSV
Cross-site Scripting in dompurify
osv·2020-12-18
CVE-2020-26870 [MEDIUM] Cross-site Scripting in dompurify
Cross-site Scripting in dompurify
Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as demonstrated by nesting of FORM elements.
OSV
CVE-2020-26870: Cure53 DOMPurify before 2
osv·2020-10-07·CVSS 6.1
CVE-2020-26870 [MEDIUM] CVE-2020-26870: Cure53 DOMPurify before 2
Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as demonstrated by nesting of FORM elements.
No detection rules found.
No public exploits indexed.
Trendmicro
January Patch Tuesday Repairs Critical MS Defender RCE Bug
blogs_trendmicro·2021-01-13·CVSS 7.8
[HIGH] January Patch Tuesday Repairs Critical MS Defender RCE Bug
Exploits & Vulnerabilities
# January Patch Tuesday Repairs Critical MS Defender RCE Bug
Microsoft welcomed the first month of 2021 with a total of 83 security updates — which is an uptick from December’s relatively lighter list.
By: Trend Micro
2021/01/13
Read time: ( words)
Save to Folio
Updated on 1/14/2021 7 p.m. PST to include TippingPoint® Next-Generation Intrusion Prevention System (NGIPS) Protection rules.
Microsoft welcomed the first month of 2021 with a total of 83 security updates — which is an uptick from December’s relatively lighter list. The January Patch Tuesday features 10 Critical and 73 Important patches. All of this month’s Critical patches are meant to fix remote code execution (RCE) vulnerabilities among certain Microsoft products, including Microsoft Defender,
arXiv
eyeballvul: a future-proof benchmark for vulnerability detection in the wild
arxiv_fulltext·2024-07-13
eyeballvul: a future-proof benchmark for vulnerability detection in the wild
*-0.5cm
center
[email protected]
center
## Abstract
Long contexts of recent LLMs have enabled a new use case: asking models to find security vulnerabilities in entire codebases. To evaluate model performance on this task, we introduce eyeballvul: a benchmark designed to test the vulnerability detection capabilities of language models at scale, that is sourced and updated weekly from the stream of published vulnerabilities in open-source repositories. The benchmark consists of a list of revisions in different repositories, each associated with the list of known vulnerabilities present at that revision. An LLM-based scorer is used to compare the list of possible vulnerabilities returned by a model to the list of known vulnerabilities for each revision. As of July 2024, eyeballvu
https://github.com/cure53/DOMPurify/commit/02724b8eb048dd219d6725b05c3000936f11d62dhttps://github.com/cure53/DOMPurify/compare/2.0.16...2.0.17https://lists.debian.org/debian-lts-announce/2020/10/msg00029.htmlhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-26870https://research.securitum.com/mutation-xss-via-mathml-mutation-dompurify-2-0-17-bypass/https://www.oracle.com//security-alerts/cpujul2021.htmlhttps://github.com/cure53/DOMPurify/commit/02724b8eb048dd219d6725b05c3000936f11d62dhttps://github.com/cure53/DOMPurify/compare/2.0.16...2.0.17https://lists.debian.org/debian-lts-announce/2020/10/msg00029.htmlhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-26870https://research.securitum.com/mutation-xss-via-mathml-mutation-dompurify-2-0-17-bypass/https://www.oracle.com//security-alerts/cpujul2021.html
2020-10-07
Published