Tampering by prototype polution in DOMPurify
Résumé
Tampering by prototype polution in DOMPurify
Description d'origine
La description telle que publiée par la source (souvent en anglais).
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also possible to use Prototype Pollution to weaken the depth check. This renders dompurify unable to avoid cross site scripting (XSS) attacks. This issue has been addressed in versions 2.5.4 and 3.1.3 of DOMPurify. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2024-45801 node-dompurify Corrigé dans: 2.4.1+dfsg+~2.4.0-2+deb12u1
- Ubuntu UBUNTU-CVE-2024-45801 node-dompurify
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- patch github.com