org.webjars.bowergithub.cure53:dompurify@2.2.9 vulnerabilities
-
latest version
2.3.3
-
first published
6 years ago
-
latest version published
3 years ago
-
licenses detected
- (Apache-2.0 OR MPL-2.0)[1.0.7,)
-
package manager
Direct Vulnerabilities
Known vulnerabilities in the org.webjars.bowergithub.cure53:dompurify package. This does not include vulnerabilities belonging to this package’s dependencies.
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.| Vulnerability | Vulnerable Version |
|---|---|
org.webjars.bowergithub.cure53:dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Prototype Pollution due to improper checks of the properties during the HTML sanitization process. How to fix Prototype Pollution? A fix was pushed into the |
[0,)
|
org.webjars.bowergithub.cure53:dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Cross-site Scripting (XSS) through the improper sanitization of nested HTML elements in the How to fix Cross-site Scripting (XSS)? There is no fixed version for |
[0,)
|
org.webjars.bowergithub.cure53:dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Prototype Pollution due to improper user input sanitization through the depth-checking mechanism, an attacker can exploit this vulnerability by using special nesting techniques to create a malicious HTML file. How to fix Prototype Pollution? There is no fixed version for |
[0,)
|
org.webjars.bowergithub.cure53:dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Template Injection in How to fix Template Injection? There is no fixed version for |
[0,)
|