Skip to content

Cross-Site Scripting in dompurify

Moderate severity GitHub Reviewed Published Aug 28, 2020 to the GitHub Advisory Database • Updated Sep 13, 2023

Package

npm dompurify (npm)

Affected versions

< 2.0.3

Patched versions

2.0.3

Description

Versions of dompurify prior to 2.0.3 are vulnerable to Cross-Site Scripting (XSS). The package has an XSS filter bypass due to Mutation XSS in both Chrome and Safari through a combination of <svg>/<math> elements and </p>/</br>. An example payload is: <svg></p><style><a id="</style><img src=1 onerror=alert(1)>">. This allows attackers to bypass the XSS protection and execute arbitrary JavaScript in a victim's browser.

Recommendation

Upgrade to version 2.0.3 or later. You may also disallow <svg> and <math> through dompurify configurations:

     FORBID_TAGS: ['svg', 'math']
 });```
### References
- https://nvd.nist.gov/vuln/detail/CVE-2019-16728
- https://research.securitum.com/dompurify-bypass-using-mxss/
- https://www.npmjs.com/advisories/1205
- https://lists.debian.org/debian-lts-announce/2020/10/msg00029.html
Reviewed Aug 28, 2020
Published to the GitHub Advisory Database Aug 28, 2020
Last updated Sep 13, 2023

Severity

Moderate
6.1
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses

CVE ID

CVE-2019-16728

GHSA ID

GHSA-chqj-j4fh-rw7m

Source code

No known source code
Checking history
See something to contribute? Suggest improvements for this vulnerability.