Cross-site Scripting in dompurify (GHSA-63q7-h895-m982)

Description

Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as demonstrated by nesting of FORM elements.

Recommendation

Update the dompurify package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.0.17
• Patched version(s): 2.0.17

References

• GHSA-63q7-h895-m982
• lists.debian.org
• research.securitum.com
• snyk.io
• portal.msrc.microsoft.com
• www.oracle.com
• CVE-2020-26870
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Cross-Site Scripting in Prism (GHSA-wvhm-4hhf-97x9) - CVE-2020-15138
• Cross-site scripting in jspdf (GHSA-vh59-v9r5-4mh4) - CVE-2020-7690
• Cross-site Scripting in Joplin (GHSA-6r7x-hc8m-985r) - CVE-2020-9038
• Cross-site scripting in Joplin (GHSA-q26w-wjj2-22vv) - CVE-2020-28249

Tags:

npm

dompurify