The vulnerability of the JavaScript library for secure cleaning and protection of HTML code, DOMPurify, is related to the use of a regular expression with inefficient computational complexity, allowing attackers to execute XSS attacks.

🗓️ 21 Oct 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 5 Views

DOMPurify vulnerability: inefficient regex in HTML cleaning allows remote cross site scripting.

Reporter	Title	Published	Views	Family All 66
IBM Security Bulletins	Security Bulletin: IBM Security SOAR is vulnerable to client-side vulnerability (CVE-2024-45801)	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: User Behavior Analytics application add on to IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	20 Nov 202413:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Observability with Instana is affected by Multiple Security Vulnerabilities	18 Nov 202415:04	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in DOMPurify affects IBM watsonx Assistant for IBM Cloud Pak for Data	5 Feb 202520:44	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for Oct 2024	14 Oct 202416:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Defender Data Protect vulnerable to CVE-2024-45801 due to dependency on Open Source library.	11 Mar 202517:47	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct Web Services is affected by DOMPurify vulnerability (CVE-2024-45801)	22 Nov 202412:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Ceph is vulnerable to Inefficient Regular Expression Complexity in Grafana (CVE-2024-45801)	29 Jul 202521:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in DOMPurify	2 May 202507:45	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM CloudPak for AIOps	15 Apr 202503:11	–	ibm

Vulners

Node

red_hat red_hat_process_automationMatch7

OR

red_hat red_hat_3scale_api_management_platformMatch2

OR

red_hat red_hat_advanced_cluster_management_for_kubernetesMatch2

OR

red_hat red_hat_openshift_container_platformMatch4

OR

red_hat red_hat_openshift_virtualizationMatch4

OR

red_hat red_hat_ansible_automation_platformMatch2

OR

red_hat red_hat_advanced_cluster_securityMatch4

OR

red_hat cryostatMatch3

OR

cure53 dompurifyRange<3.1.3

OR

cure53 dompurifyRange<2.5.4

OR

oracle oracle_application_expressMatch23.2

OR

oracle oracle_application_expressMatch24.1

OR

red_hat red_hat_enterprise_linuxMatch9

OR

red_hat red_hat_openshift_logging_(rhol)Match5.9

Source	Link
github	www.github.com/cure53/DOMPurify/commit/1e520262bf4c66b5efda49e2316d6d1246ca7b21
github	www.github.com/cure53/DOMPurify/commit/26e1d69ca7f769f5c558619d644d90dd8bf26ebc
github	www.github.com/cure53/DOMPurify/security/advisories/GHSA-mmhx-hmjr-r674
access	www.access.redhat.com/security/cve/cve-2024-45801
oracle	www.oracle.com/security-alerts/cpuoct2024.html
cybersecurity-help	www.cybersecurity-help.cz/vdb/SB2024092751
cybersecurity-help	www.cybersecurity-help.cz/vdb/SB20241015115
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
lk	www.lk.astra.ru/
wiki	www.wiki.astralinux.ru/x/ziLoD

09 Feb 2026 00:00Current

7.2High risk

Vulners AI Score7.2

CVSS 37.3

CVSS 27.5

EPSS0.00844

dompurify cross site scripting inefficient regex html sanitization security vulnerability