CVE-2024-45801

HIGH

DOMPurify < 2.5.4 - Cross-Site Scripting Bypass via Depth Check Evasion

Title source: llm
STIX 2.1

Description

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also possible to use Prototype Pollution to weaken the depth check. This renders dompurify unable to avoid cross site scripting (XSS) attacks. This issue has been addressed in versions 2.5.4 and 3.1.3 of DOMPurify. All users are advised to upgrade. There are no known workarounds for this vulnerability.

References (3)

Core 3

Scores

CVSS v3 7.3
EPSS 0.0086
EPSS Percentile 53.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-1333 CWE-1321
Status published
Products (2)
cure53/dompurify < 2.5.4
npm/dompurify 0 - 2.5.4npm
Published Sep 16, 2024
Tracked Since Feb 18, 2026