PT-2023-31065 · Unknown · Domsanitizer

Rhukster · Published 2023-11-22 · Updated 2023-11-28 · CVE-2023-49146

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions DOMSanitizer versions prior to 1.0.7

Description The issue arises from the mishandling of comments and the use of greedy regular expressions in SVG documents, leading to a potential XSS attack.

Recommendations For versions prior to 1.0.7, update to version 1.0.7 or later to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-49146

GHSA-2GHM-R75J-PJX2

Affected Products

Domsanitizer

References · 6

• https://github.com/rhukster/dom-sanitizer/compare/1.0.6...1.0.7 · Patch
• https://github.com/rhukster/dom-sanitizer/commit/c2a98f27ad742668b254282ccc5581871d0fb601 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-49146 · Security Note
• https://osv.dev/vulnerability/CVE-2023-49146 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2ghm-r75j-pjx2 · Vendor Advisory
• https://github.com/rhukster/dom-sanitizer · Note