PT-2023-9640 · Dompurify · Dompurify
Eslerm
·
Publicado
2023-01-05
·
Atualizado
2025-09-23
·
CVE-2024-48910
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
DOMPurify versions prior to 2.4.2
Description
The issue is related to an uncontrolled modification of object prototype attributes in the DOMPurify JavaScript library, which is used for secure cleaning and protection of HTML code. This can allow a remote attacker to impact the confidentiality and integrity of protected information. The library is vulnerable to prototype pollution, which can lead to improper object modification and potential remote code execution.
Recommendations
For DOMPurify versions prior to 2.4.2, update to version 2.4.2 or later to fix the vulnerability. As a temporary workaround, consider restricting the use of the
proto property and the hasOwnField function to minimize the risk of exploitation. Avoid using the ALLOWED ATTR values in the affected HTML sanitization process until the issue is resolved.Exploit
Correção
Prototype Pollution
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Dompurify