DOMPurify vulnerable to tampering by prototype polution

Description

dompurify was vulnerable to prototype pollution

Fixed by https://github.com/cure53/DOMPurify/commit/d1dd0374caef2b4c56c3bd09fe1988c3479166dc

Recommendation

Update the dompurify package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.4.2
• Patched version(s): 2.4.2

References

• GHSA-p3vf-v8qc-cwcr
• lists.debian.org
• CVE-2024-48910
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Cross-site Scripting in dompurify (GHSA-63q7-h895-m982) - CVE-2020-26870
• cors-anywhere vulnerable to server-side request forgery - CVE-2020-36851
• [email protected] contains malware after npm account takeover - CVE-2025-59144
• DOMPurify allows Cross-site Scripting (XSS) - CVE-2025-26791

Tags:

npm

dompurify