Cure53

Dompurify

8 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
7.5

CVE-2025-48050

Media report
  • EPSS 0.09%
  • Published 15.05.2025 00:00:00
  • Last modified 16.05.2025 15:15:48

In DOMPurify through 3.2.5 before 6bc6d60, scripts/server.js does not ensure that a pathname is located under the current working directory. NOTE: the Supplier disputes the significance of this report because the "Uncontrolled data used in path expre...

4.5

CVE-2025-26791

  • EPSS 0.02%
  • Published 14.02.2025 09:15:08
  • Last modified 14.02.2025 16:15:37

DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS).

9.8

CVE-2024-48910

  • EPSS 0.41%
  • Published 31.10.2024 15:15:15
  • Last modified 23.09.2025 02:01:59

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability is fixed in 2.4.2.

6.1

CVE-2024-47875

Exploit
  • EPSS 0.15%
  • Published 11.10.2024 15:15:05
  • Last modified 29.09.2025 17:29:34

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3.

6.1

CVE-2024-45801

  • EPSS 0.09%
  • Published 16.09.2024 19:16:11
  • Last modified 22.09.2025 17:15:13

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also po...

6.1

CVE-2019-25155

  • EPSS 0.24%
  • Published 07.11.2023 03:09:22
  • Last modified 21.11.2024 04:39:59

DOMPurify before 1.0.11 allows reverse tabnabbing in demos/hooks-target-blank-demo.html because links lack a 'rel="noopener noreferrer"' attribute.

6.1

CVE-2020-26870

Exploit
  • EPSS 0.29%
  • Published 07.10.2020 16:15:18
  • Last modified 21.11.2024 05:20:23

Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as demonstrated by nesting of FORM elements.

6.1

CVE-2019-16728

Exploit
  • EPSS 1.19%
  • Published 24.09.2019 05:15:11
  • Last modified 21.11.2024 04:31:04

DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demonstrated by Chrome and Safari.