Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-chqj-j4fh-rw7m

Опубликовано: 28 авг. 2020
Источник: github
Github: Прошло ревью
CVSS3: 6.1

Описание

Cross-Site Scripting in dompurify

Versions of dompurify prior to 2.0.3 are vulnerable to Cross-Site Scripting (XSS). The package has an XSS filter bypass due to Mutation XSS in both Chrome and Safari through a combination of <svg>/&lt;math&gt; elements and </p>/</br>. An example payload is: <svg></p><style><a id="</style><img src=1 onerror=alert(1)>">. This allows attackers to bypass the XSS protection and execute arbitrary JavaScript in a victim's browser.

Recommendation

Upgrade to version 2.0.3 or later. You may also disallow <svg> and &lt;math&gt; through dompurify configurations:

FORBID_TAGS: ['svg', 'math'] });```

Пакеты

Наименование

dompurify

npm
Затронутые версииВерсия исправления

< 2.0.3

2.0.3

EPSS

Процентиль: 78%
0.01188
Низкий

6.1 Medium

CVSS3

Дефекты

CWE-79

Связанные уязвимости

CVSS3: 6.1
ubuntu
больше 6 лет назад

DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demonstrated by Chrome and Safari.

CVSS3: 6.1
nvd
больше 6 лет назад

DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demonstrated by Chrome and Safari.

CVSS3: 6.1
debian
больше 6 лет назад

DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (m ...

EPSS

Процентиль: 78%
0.01188
Низкий

6.1 Medium

CVSS3

Дефекты

CWE-79