DOMPurify Open Redirect vulnerability

Description

DOMPurify before 1.0.11 allows reverse tabnabbing in demos/hooks-target-blank-demo.html because links lack a ‘rel=”noopener noreferrer”’ attribute.

Recommendation

Update the dompurify package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.0.11
• Patched version(s): 1.0.11

References

• GHSA-8hgg-xxm5-3873
• CVE-2019-25155
• CWE-601
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Feathers has an open redirect in OAuth callback enables account takeover - CVE-2026-27191
• NASA Open MCT Cross Site Scripting vulnerability - CVE-2023-45885
• Open Redirect in url-parse - CVE-2018-3774
• Cross-Site Scripting in dompurify - CVE-2019-16728

You might also like:

Exploiting Server Version Disclosure

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Tags:

npm

dompurify