Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2026-65898 →
DEBIAN-CVE-2026-65898
DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to pe...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
node-dompurify
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13
node-dompurify
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:14
node-dompurify
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.12+dfsg-1"}]}]
Références
- advisory security-tracker.debian.org