CVE-2024-47875

MEDIUM EPSS 61.3%
Published Oct 11, 20241y ago · Modified Jun 17, 20262w ago
6.1 CVSS 3.1
Medium
Find Similar
Published Oct 11, 2024 1y ago
Last Modified Jun 17, 2026 2w ago

Description

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3.

CVSS Details

Base Score
6.1
Exploitability
2.8
Impact
2.7
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Changed
Confidentiality Low
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
61.3% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 2

VendorProductVersionRange
cure53dompurify* <2.5.0
cure53dompurify*≥3.0.0  –  <3.1.3

References 6

  • seclists.org http://seclists.org/fulldisclosure/2025/Apr/14
  • github.com https://github.com/cure53/DOMPurify/blob/0ef5e537a514f904b6aa1d7ad9e749e365d7185f/test/test-suite.js#L2098
    Product
  • github.com https://github.com/cure53/DOMPurify/commit/0ef5e537a514f904b6aa1d7ad9e749e365d7185f
    Patch
  • github.com https://github.com/cure53/DOMPurify/commit/6ea80cd8b47640c20f2f230c7920b1f4ce4fdf7a
    Patch
  • github.com https://github.com/cure53/DOMPurify/security/advisories/GHSA-gx9m-whjm-85jf
    ExploitThird Party Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2025/02/msg00010.html

Remediation

  • github.com https://github.com/cure53/DOMPurify/commit/0ef5e537a514f904b6aa1d7ad9e749e365d7185f
    Patch
  • github.com https://github.com/cure53/DOMPurify/commit/6ea80cd8b47640c20f2f230c7920b1f4ce4fdf7a
    Patch