CVE-2024-48910: DOMPurify Prototype Pollution Vulnerability
Summary
CVE-2024-48910: DOMPurify vulnerable to tampering by prototype polution. Affects dompurify versions < 2.4.2. Fixed in 2.4.2. How to fix ↓
Also tracked for
- cacti · Debian:11
The same CVE-2024-48910 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
DOMPurify is a popular JavaScript library used to sanitize HTML and prevent XSS (Cross-Site Scripting) attacks. It is widely utilized in web applications to ensure that user-generated content is safe for rendering in the browser. The library is designed to be fast and secure, making it a go-to choice for developers looking to protect their applications from malicious input. However, a recent vulnerability has been identified that allows for prototype pollution, which can lead to unexpected behavior and security risks.
Vulnerability Detail
The vulnerability in DOMPurify arises from its susceptibility to prototype pollution, a type of attack where an attacker can manipulate the prototype of an object, potentially leading to the execution of arbitrary code or the alteration of application behavior. This issue can be exploited by crafting malicious input that modifies the prototype chain, allowing attackers to introduce or modify properties on objects globally. The ramifications of this vulnerability are severe, as it can compromise the integrity of the application and expose sensitive data.
How To Fix
Latest published version: 3.4.17 as of 22 Oct 2026
npm install dompurify@3.4.17Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.4.2
This is the first release that contains the fix.
npm install dompurify@2.4.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation to sanitize user inputs before passing them to DOMPurify. This can help mitigate the risk of prototype pollution until the package is updated. However, the best practice is to apply the patch as soon as possible.
Conclusion
The DOMPurify vulnerability (CVE-2024-48910) highlights the importance of maintaining up-to-date libraries in web applications. By understanding the nature of prototype pollution and taking proactive steps to update the affected package, developers can safeguard their applications against potential attacks. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for dompurify →
FAQ
Prototype pollution is a security vulnerability that allows an attacker to manipulate the prototype of a JavaScript object, potentially leading to unauthorized access or modification of data.
You can check if your application is affected by using tools like Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can also use the Vulert playground to analyze your package-lock.json without any signup.
Exploitation of this vulnerability can lead to arbitrary code execution, data leakage, and manipulation of application behavior, posing significant security risks.
Regularly updating dependencies and using security tools to monitor for vulnerabilities can help prevent similar issues in the future. Additionally, implementing strict input validation can mitigate risks.
The CVSS score of this vulnerability is 9.1, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for dompurify.
