Critical Security Update for node-dompurify: Addressing CVE-2024-47875
Summary
DSA-5790-1: node-dompurify - security update. Affects node-dompurify versions < 2.4.1+dfsg+~2.4.0-2. Fixed in 2.4.1+dfsg+~2.4.0-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-dompurify is a popular JavaScript library used for sanitizing HTML and preventing XSS (Cross-Site Scripting) attacks. It is widely utilized in web applications to ensure that user-generated content is safe for rendering in browsers. The library is designed to clean potentially harmful HTML, making it essential for developers aiming to secure their applications. However, recent findings have revealed a vulnerability that could expose applications using outdated versions of this package to security risks.
Vulnerability Detail
The vulnerability identified as CVE-2024-47875 affects node-dompurify versions prior to 2.4.1+dfsg+~2.4.0-2. This issue arises from inadequate sanitization processes, which could allow attackers to inject malicious scripts into web applications. If exploited, this vulnerability could lead to unauthorized access, data leakage, or complete compromise of the affected systems. It is crucial for developers to address this vulnerability promptly to maintain the integrity and security of their applications.
How To Fix
Minimum fixed version
2.4.1+dfsg+~2.4.0-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-dompurifyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing additional input validation and sanitization measures in your application to mitigate the risk of XSS attacks. However, this is not a substitute for updating the vulnerable package.
Conclusion
The discovery of CVE-2024-47875 in node-dompurify highlights the importance of maintaining up-to-date software dependencies to safeguard web applications from potential security threats. Developers are urged to update to the patched version promptly and consider utilizing tools like Vulert for ongoing monitoring.
See every vulnerability recorded for node-dompurify →
FAQ
CVE-2024-47875 is a security vulnerability in the node-dompurify package that allows for potential XSS attacks due to inadequate sanitization.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failing to address this vulnerability could lead to unauthorized access, data breaches, and exploitation of your web application.
Yes, Vulert provides a service that monitors your open-source dependencies for vulnerabilities using just a manifest file like package-lock.json.
It is recommended to regularly check for updates and security patches for your dependencies, ideally on a monthly basis or whenever a new vulnerability is disclosed.
Related vulnerabilities
Recent vulnerabilities recorded for node-dompurify.
