CVE-2025-48050: In DOMPurify through 3.2.5 before 6bc6d60, scripts/server.js does not ensure that a pathname is located under the current working directory. NOTE: the Supplier…

PriorityP340high7.5CVSS 3.1

AVNACHPRNUINSCCHILAN

EPSS

0.41%

33.6th percentile

In DOMPurify through 3.2.5 before 6bc6d60, scripts/server.js does not ensure that a pathname is located under the current working directory. NOTE: the Supplier disputes the significance of this report because the "Uncontrolled data used in path expression" occurs "in a development helper script which starts a local web server if needed and must be manually started."

Affected

2 ranges

Vendor	Product	Version range	Fixed in
cure53	dompurify	<= 3.2.5	—
debian	node-dompurify	—	—

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N

osv7.5HIGH

vendor_debian7.5LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.