DOMPurify Open Redirect vulnerability

Description

DOMPurify before 1.0.11 allows reverse tabnabbing in demos/hooks-target-blank-demo.html because links lack a ‘rel=”noopener noreferrer”’ attribute.

Recommendation

Update the dompurify package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.0.11
• Patched version(s): 1.0.11

References

• GHSA-8hgg-xxm5-3873
• CVE-2019-25155
• CWE-601
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Open redirect in @auth0/nextjs-auth0 - CVE-2021-43812
• Open Redirect in urijs - CVE-2022-0868
• @okta/oidc-middlewareOpen Redirect vulnerability - CVE-2022-3145
• Open Redirect in node-forge - CVE-2022-0122

You might also like:

Exploiting Server Version Disclosure

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Tags:

npm

dompurify