dom-iterator code execution vulnerability

Description

Versions of the package dom-iterator before 1.0.1 are vulnerable to Arbitrary Code Execution due to use of the Function constructor without complete input sanitization. Function generates a new function body and thus care must be given to ensure that the inputs to Function are not attacker-controlled.

Recommendation

Update the dom-iterator package to the latest compatible version. Followings are version details:

• Affected version(s): <= 1.0.0
• Patched version(s): 1.0.1

References

• GHSA-jrvm-mcxc-mf6m
• security.snyk.io
• CVE-2024-21541
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Trix Editor Arbitrary Code Execution Vulnerability - CVE-2024-34341
• JSONPath Plus Remote Code Execution (RCE) Vulnerability - CVE-2024-21534
• Happy DOM: VM Context Escape can lead to Remote Code Execution - CVE-2025-61927
• PrismJS DOM Clobbering vulnerability - CVE-2024-53382

You might also like:

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Exploiting Server Version Disclosure

Tags:

npm

dom-iterator