CVE-2024-45801: cure53 dompurify
CVSS: 7.3v3.1HighAnalyzed
AliasesUBUNTU-CVE-2024-45801DEBIAN-CVE-2024-45801CGA-5pj9-g9cr-7vxmCGA-92g5-hh6f-w9jrGHSA-mmhx-hmjr-r674CGA-24jw-5gf5-4634CGA-289f-jhjw-c3q2CGA-2hx9-p4gq-86fhCGA-2j5w-49gw-m67pCGA-2x78-598q-5p89CGA-3g98-r5fp-chpmCGA-3jgc-9gfh-6w2wCGA-4235-h62w-6m9qCGA-4gjw-8h2h-3q6cCGA-4qr4-38qw-cx2rCGA-4rv4-6hh2-9543CGA-4v43-m48g-37c3CGA-5fv4-8hm9-9vcmCGA-642m-96mp-g9gcCGA-6m9c-7xj2-7f38CGA-76xw-pr35-p95qCGA-7pmc-5483-3688CGA-7r2c-cg5r-j58cCGA-8pv5-4h9f-274fCGA-9853-fxc8-542jCGA-9c82-qmc2-v9p4CGA-9gqj-ghqj-rfvgCGA-c483-h7wq-72c9CGA-cf7v-v2rg-jwwmCGA-cf8q-4qhh-hgrqCGA-cvrx-38c4-m92cCGA-cx8j-6c3j-9crvCGA-fg96-37x7-6chwCGA-fjrq-99h7-f35pCGA-fm2r-jjxp-66h6CGA-g65g-3qg4-3g5rCGA-g8j5-m7gf-c8pfCGA-gh97-6hhq-h39jCGA-gvx3-pfjm-v5h7CGA-hchh-p787-hf7gCGA-j7c9-73wf-27qrCGA-jf52-4x79-942jCGA-jrh8-2qpg-2wh5CGA-jv5c-4j5r-phhgCGA-jwpf-67p7-3fj8CGA-jwwp-pwxp-9gj9CGA-m5g2-vrmf-cv5mCGA-mfx2-pxgp-jmgmCGA-pw9m-x97v-3g74CGA-q3r5-638w-hpvpCGA-q52p-hvrj-7rqpCGA-q7p8-qvm7-mwhjCGA-q9fw-chrc-7vwjCGA-rphh-m9q5-8834CGA-rw6h-4rf3-h4p7CGA-v8qf-j9m7-65x5CGA-vggx-3499-hw9hCGA-vh3q-3m8w-xq8pCGA-vjfm-rmr6-p68wCGA-vxcp-h8h8-2qxwCGA-w65m-hj76-w9gfCGA-wm4v-f3qg-xw9mCGA-x8fv-mv5j-p2f5CGA-x964-xp98-vmv2CGA-xp2g-8fhf-mcr3
Published 16-09-2024Last modified 16-09-2024
Vulnerability summary
CVE-2024-45801 is a high (CVSS 7.3) vulnerability in cure53 dompurify. EPSS estimates a 0.89% chance of exploitation in the next 30 days, higher than 58.8% of scored vulnerabilities.
CVSS score
7.3/10
010
High · v3.1 (CVE.org)EPSS score
0.89%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1 · Related 3Timeline
- 16-09-2024PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also possible to use Prototype Pollution to weaken the depth check. This renders dompurify unable to avoid cross site scripting (XSS) attacks. This issue has been addressed in versions 2.5.4 and 3.1.3 of DOMPurify. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS metrics
8 scores · 7 sources · 2 versionsHigh 8.3Preferred score · OSV · Npm (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:NSourcesSingle source
High 7.3Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LSources7 sources · 6.1–7.3
- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NDiffers
- OSV · DebianEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NDiffers
- OSV · WolfiEcosystem advisory · calculated7.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- OSV · NpmEcosystem advisory · calculated7.0HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:LDiffers
- OSV · ChainguardEcosystem advisory · calculated7.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- NVDNIST6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NDiffers
EPSS trend
Probability
0.89%
Chance of exploitation in the next 30 days
Percentile
59%
Versus all other CVEs
30-day change
0.00 pp
From 0.89% on 19-09-2026
19-09-202619-10-2026
EPSS score0.89%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-1333Inefficient Regular Expression ComplexityThe product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
- CWE-1321Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Affected systems
Chainguard31 products
- argo-workflows< 3.6.0-r0
- opensearch-dashboards-2< 2.19.1-r3
- opensearch-dashboards-2-alerting-dashboards-plugin< 2.19.1-r3
- opensearch-dashboards-2-anomaly-detection-dashboards-plugin< 2.19.1-r3
- opensearch-dashboards-2-config< 2.19.1-r3
Cure531 product
- dompurify< 2.5.4 | ≥ 3.0.0, < 3.1.3
Debian1 product
- node-dompurify< 2.4.1+dfsg+~2.4.0-2+deb12u1
Npm1 product
- dompurify< 2.5.4 | ≥ 3.0.0, < 3.1.3
Ubuntu1 product
- node-dompurifyAll versions (No fix recorded)
Wolfi1 product
- argo-workflows< 3.6.0-r0
6 vendors · 36 products
References
9 links- github.com/cure53/DOMPurify/security/advisories/GHSA-mmhx-hmjr-r674X Refsource CONFIRMREPORTAdvisoryWEBThird Party Advisory
- github.com/cure53/DOMPurify/commit/1e520262bf4c66b5efda49e2316d6d1246ca7b21X Refsource MISCREPORTFIXWEBPatch
- github.com/cure53/DOMPurify/commit/26e1d69ca7f769f5c558619d644d90dd8bf26ebcX Refsource MISCREPORTFIXWEBPatch
- github.com/cure53/DOMPurifyPACKAGE