CVE-2024-48910
published 2024-10-31CVE-2024-48910: DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability…
PriorityP345critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.18%
64.3th percentile
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability is fixed in 2.4.2.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cacti | cacti | >= 0 < 1.2.16+ds1-2+deb11u5 | 1.2.16+ds1-2+deb11u5 |
| cacti | cacti | >= 0 < 1.2.24+ds1-1+deb12u2 | 1.2.24+ds1-1+deb12u2 |
| cacti | cacti | >= 0 < 1.2.26+ds1-1 | 1.2.26+ds1-1 |
| cacti | cacti | >= 0 < 1.2.26+ds1-1 | 1.2.26+ds1-1 |
| cure53 | dompurify | < 2.4.2 | 2.4.2 |
| cure53 | dompurify | >= 0 < 2.4.2 | 2.4.2 |
| debian | cacti | < cacti 1.2.24+ds1-1+deb12u2 (bookworm) | cacti 1.2.24+ds1-1+deb12u2 (bookworm) |
| debian | node-dompurify | < cacti 1.2.24+ds1-1+deb12u2 (bookworm) | cacti 1.2.24+ds1-1+deb12u2 (bookworm) |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv9.8CRITICAL
vendor_debian9.1CRITICAL
vendor_redhat9.1CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2024-48910: DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG
osv·2024-10-31·CVSS 9.8
CVE-2024-48910 [CRITICAL] CVE-2024-48910: DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability is fixed in 2.4.2.
GHSA
DOMPurify vulnerable to tampering by prototype polution
ghsa·2024-10-31
CVE-2024-48910 [CRITICAL] CWE-1321 DOMPurify vulnerable to tampering by prototype polution
DOMPurify vulnerable to tampering by prototype polution
dompurify was vulnerable to prototype pollution
Fixed by https://github.com/cure53/DOMPurify/commit/d1dd0374caef2b4c56c3bd09fe1988c3479166dc
OSV
DOMPurify vulnerable to tampering by prototype polution
osv·2024-10-31
CVE-2024-48910 [CRITICAL] DOMPurify vulnerable to tampering by prototype polution
DOMPurify vulnerable to tampering by prototype polution
dompurify was vulnerable to prototype pollution
Fixed by https://github.com/cure53/DOMPurify/commit/d1dd0374caef2b4c56c3bd09fe1988c3479166dc
Red Hat
dompurify: DOMPurify vulnerable to tampering by prototype pollution
vendor_redhat·2024-10-31·CVSS 9.1
CVE-2024-48910 [CRITICAL] CWE-1321 dompurify: DOMPurify vulnerable to tampering by prototype pollution
dompurify: DOMPurify vulnerable to tampering by prototype pollution
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability is fixed in 2.4.2.
A prototype pollution vulnerability was found in DOMPurify. This flaw allows a remote attacker to add or modify attributes of an object prototype. This issue can lead to the injection of malicious attributes used in other components or cause a crash by overriding existing attributes with ones of incompatible type.
Statement: The prototype pollution vulnerability in DOMPurify is considered a high-severity issue because it allows attackers to modify the prototype of built-in JavaScript objects, potentially impacting the entire application. This co
Debian
CVE-2024-48910: cacti - DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathM...
vendor_debian·2024·CVSS 9.1
CVE-2024-48910 [CRITICAL] CVE-2024-48910: cacti - DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathM...
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability is fixed in 2.4.2.
Scope: local
bookworm: resolved (fixed in 1.2.24+ds1-1+deb12u2)
bullseye: resolved (fixed in 1.2.16+ds1-2+deb11u5)
forky: resolved (fixed in 1.2.26+ds1-1)
sid: resolved (fixed in 1.2.26+ds1-1)
trixie: resolved (fixed in 1.2.26+ds1-1)
No detection rules found.
No public exploits indexed.
2024-10-31
Published