PT-2023-9640 · Dompurify · Dompurify

Eslerm · Published 2023-01-05 · Updated 2025-09-23 · CVE-2024-48910

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DOMPurify versions prior to 2.4.2

Description The issue is related to an uncontrolled modification of object prototype attributes in the DOMPurify JavaScript library, which is used for secure cleaning and protection of HTML code. This can allow a remote attacker to impact the confidentiality and integrity of protected information. The library is vulnerable to prototype pollution, which can lead to improper object modification and potential remote code execution.

Recommendations For DOMPurify versions prior to 2.4.2, update to version 2.4.2 or later to fix the vulnerability. As a temporary workaround, consider restricting the use of the proto property and the hasOwnField function to minimize the risk of exploitation. Avoid using the ALLOWED ATTR values in the affected HTML sanitization process until the issue is resolved.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

BDU:2024-09092

CVE-2024-48910

DLA-4048-1

GHSA-P3VF-V8QC-CWCR

Affected Products

Dompurify

References · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/48xxx/CVE-2024-48910.json · Exploit
• https://github.com/cure53/DOMPurify/commit/d1dd0374caef2b4c56c3bd09fe1988c3479166dc · Patch
• https://github.com/cure53/DOMPurify/security/advisories/GHSA-p3vf-v8qc-cwcr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-48910 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-48910 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-09092 · Security Note
• https://ubuntu.com/security/CVE-2024-48910 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-48910 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p3vf-v8qc-cwcr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-48910 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4048-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-48910 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-48910 · Vendor Advisory
• https://github.com/cure53/DOMPurify · Note
• https://twitter.com/VulmonFeeds/status/1852027120261689661 · Twitter Post