DOMPurify Open Redirect vulnerability

Description

DOMPurify before 1.0.11 allows reverse tabnabbing in demos/hooks-target-blank-demo.html because links lack a ‘rel=”noopener noreferrer”’ attribute.

Recommendation

Update the dompurify package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.0.11
• Patched version(s): 1.0.11

References

• GHSA-8hgg-xxm5-3873
• CVE-2019-25155
• CWE-601
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Open Redirect in url-parse - CVE-2018-3774
• Oils JS vulnerable to Open Redirect - CVE-2021-4260
• Open redirect in karma - CVE-2021-23495
• Open Redirect in urijs - CVE-2022-0868

Tags:

npm

dompurify