Homepage
About Snyk

Template Injection Affecting dompurify package, versions <2.4.9 >=3.0.0 <3.0.11

Severity

 Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team

    Threat Intelligence

    Exploit Maturity
    Proof of concept

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JS-DOMPURIFY-6474511
  • published 11 Apr 2024
  • disclosed 20 Mar 2024
  • credit Ry0Tak
Report a new vulnerability Found a mistake?

Introduced: 20 Mar 2024

CVE NOT AVAILABLE CWE-1336 Open this link in a new tab

How to fix?

Upgrade dompurify to version 2.4.9, 3.0.11 or higher.

Overview

dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG.

Affected versions of this package are vulnerable to Template Injection in purify.js, due to inconsistencies in the parsing of XML and HTML tags. Executable code can be injected in HTML inside XML CDATA blocks.

PoC 

<![CDATA[ ><img src onerror=alert(1)> ]]>

CVSS Scores

version 3.1
Expand this section

Snyk

Recommended
5.3 medium
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    Low
  • Privileges Required (PR)
    None
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    None
  • Integrity (I)
    None
  • Availability (A)
    Low