Critical XSS Vulnerability in node-dompurify: Upgrade Required
Summary
UBUNTU-CVE-2024-45801: DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. Affects node-dompurify versions 2.3.0+dfsg-2 – 2.3.3+dfsg-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-dompurify is a widely used library designed to sanitize HTML, MathML, and SVG content in web applications, ensuring that malicious scripts cannot execute in the browser. It is known for its speed and tolerance to various input formats, making it a popular choice among developers. However, recent vulnerabilities have raised concerns about its effectiveness in preventing cross-site scripting (XSS) attacks, particularly due to specific nesting techniques that can bypass its security measures.
Vulnerability Detail
The vulnerability, identified as CVE-2024-45801, arises from a flaw in the depth checking mechanism of DOMPurify. Malicious HTML can exploit special nesting techniques to bypass these checks, leading to potential XSS attacks. Additionally, Prototype Pollution can be used to weaken the depth check, further compromising the library's ability to protect against such attacks. This vulnerability affects versions prior to 2.5.4 and 3.1.3, making it critical for users to upgrade to the patched versions to maintain security.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no known workarounds for this vulnerability. The best course of action is to upgrade to the patched versions of node-dompurify as soon as possible.
Conclusion
The CVE-2024-45801 vulnerability in node-dompurify poses a significant risk of XSS attacks due to flaws in its depth checking mechanism. Users are strongly advised to upgrade to the patched versions to ensure the security of their applications. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for node-dompurify →
FAQ
CVE-2024-45801 is a critical vulnerability in the node-dompurify library that allows malicious HTML to bypass security checks, leading to potential XSS attacks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Versions prior to 2.5.4 and 3.1.3 of node-dompurify are affected by this vulnerability.
There are currently no workarounds available for this vulnerability, so it is crucial to prioritize upgrading to the patched versions.
The CVSS score of CVE-2024-45801 is 7.3, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for node-dompurify.
