DOMPurify vulnerable to tampering by prototype polution

Description

dompurify was vulnerable to prototype pollution

Fixed by https://github.com/cure53/DOMPurify/commit/d1dd0374caef2b4c56c3bd09fe1988c3479166dc

Recommendation

Update the dompurify package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.4.2
• Patched version(s): 2.4.2

References

• GHSA-p3vf-v8qc-cwcr
• CVE-2024-48910
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Cross-site Scripting in dompurify (GHSA-63q7-h895-m982) - CVE-2020-26870
• DOMPurify allows Cross-site Scripting (XSS) - CVE-2025-26791
• Valid ECDSA signatures erroneously rejected in Elliptic - CVE-2024-48948
• Trix vulnerable to Cross-site Scripting on copy & paste - CVE-2025-46812

Tags:

npm

dompurify