Template Injection Affecting org.webjars.npm:dompurify package, versions [,2.5.0) [3.0.1,3.1.0)
Threat Intelligence
Exploit Maturity
Proof of concept
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGWEBJARSNPM-6474512
- published 11 Apr 2024
- disclosed 20 Mar 2024
- credit Ry0Tak
How to fix?
Upgrade org.webjars.npm:dompurify to version 2.5.0, 3.1.0 or higher.
Overview
org.webjars.npm:dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.
Affected versions of this package are vulnerable to Template Injection in purify.js, due to inconsistencies in the parsing of XML and HTML tags. Executable code can be injected in HTML inside XML CDATA blocks.
PoC
<![CDATA[ ><img src onerror=alert(1)> ]]>
References
CVSS Scores
version 3.1