DOMPurify vulnerable to tampering by prototype polution

Description

dompurify was vulnerable to prototype pollution

Fixed by https://github.com/cure53/DOMPurify/commit/d1dd0374caef2b4c56c3bd09fe1988c3479166dc

Recommendation

Update the dompurify package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.4.2
• Patched version(s): 2.4.2

References

• GHSA-p3vf-v8qc-cwcr
• lists.debian.org
• CVE-2024-48910
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• DOMPurify allows tampering by prototype pollution - CVE-2024-45801
• ag-grid packages vulnerable to Prototype Pollution (GHSA-328p-362g-r48j) 2 - CVE-2024-39001
• ag-grid packages vulnerable to Prototype Pollution - CVE-2024-39001
• ag-grid packages vulnerable to Prototype Pollution (GHSA-328p-362g-r48j) - CVE-2024-39001

Tags:

npm

dompurify