CVE-2025-26791

DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting mXSS...

PT-2025-7240

Name of the Vulnerable Software and Affected Versions: DOMPurify versions prior to 3.2.4 Description: The issue is related to an incorrect template literal regular expression in DOMPurify, which can lead to mutation cross-site scripting mXSS. Recommendations: For versions prior to 3.2.4, update t...

CVE-2025-26791

DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting mXSS...

CVE-2025-26791

DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting mXSS...

Security Bulletin: Vulnerability in DOMPurify affects IBM watsonx Assistant for IBM Cloud Pak for Data

Summary Potential vulnerability in DOMPurify has been identified that affects IBM watsonx Assistant for IBM Cloud Pak for Data. The vulnerabilities have been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2024-45801 DESCRIPTION: DOMPurify could allow a...

Atlassian Jira 9.4.x < 9.4.28 / 9.12.x < 9.12.15 / 9.17.x < 9.17.4 / 10.0.x < 10.1.1 XSS (JRASERVER-78199)

The version of Atlassian Jira Server running on the remote host is affected by a vulnerability as referenced in the JRASERVER-78199 advisory. - DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has been discovered that malicious HTML using special nesti...

AlmaLinux 9 : grafana (ALSA-2024:8678)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:8678 advisory. golang-fips: Golang FIPS zeroed buffer CVE-2024-9355 dompurify: nesting-based mutation XSS vulnerability CVE-2024-47875 Tenable has extracted the precedin...

DOMPurify 安全漏洞

DOMPurify is a DOM Document Object Model for HTML, MathML and SVG written in JavaScript by Cure53 Personal Developer. A security vulnerability exists in DOMPurify versions prior to 2.4.2, which stems from susceptibility to prototype contamination...

Prototype Pollution

Mermaid is vulnerable to prototype pollution.The vulnerability is due to prototype pollution in its bundled version of DOMPurify, which allows attackers to manipulate object properties in JavaScript, potentially causing unintended behavior in applications...

PT-2024-40360 · Npm +1 · Mermaid +1

Name of the Vulnerable Software and Affected Versions: Mermaid versions prior to the version containing the fix for the DOMPurify vulnerability Description: The Mermaid NPM package contains a vulnerable version of DOMPurify, potentially resulting in an XSS attack. This issue affects users who use...

GHSA-GX9M-WHJM-85JF DOMpurify has a nesting-based mXSS

DOMpurify was vulnerable to nesting-based mXSS fixed by 0ef5e537 2.x and merge 943 Backporter should be aware of GHSA-mmhx-hmjr-r674 CVE-2024-45801 when cherry-picking POC is avaible under test...

PT-2024-6805

Name of the Vulnerable Software and Affected Versions DOMPurify versions prior to 2.5.0 DOMPurify versions prior to 3.1.3 Description The issue is related to insufficient input validation in the DOMPurify JavaScript library, which can lead to a cross-site scripting XSS attack. This vulnerability...

Cross Site Scripting(XSS)

DOMPurify is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper depth checking, which can be bypassed through special HTML nesting techniques and prototype pollution, allowing an attacker to execute malicious scripts in the victim's browser...

DOMPurify 安全漏洞

DOMPurify is a DOM Document Object Model for HTML, MathML and SVG written in JavaScript by Cure53 Personal Developer. A security vulnerability exists in DOMPurify versions prior to 2.5.4 and prior to 3.1.3, which stems from malicious HTML using a special nesting technique to bypass the depth...

PT-2024-7008

Name of the Vulnerable Software and Affected Versions DOMPurify versions prior to 2.5.4 DOMPurify versions prior to 3.1.3 Description The issue is related to the DOMPurify library, which is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML, and SVG. It has been discovered that...

Server side request forgery in SwaggerUI

SwaggerUI supports displaying remote OpenAPI definitions through the ?url parameter. This enables robust demonstration capabilities on sites like petstore.swagger.io, editor.swagger.io, and similar sites, where users often want to see what their OpenAPI definitions would look like rendered...

The vulnerability of the DOMPurify library, related to the lack of protective measures for the structure of web pages, allows attackers to execute cross-site scripting attacks.

The vulnerability of the DOMPurify library is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability can allow an attacker operating remotely to perform a cross-site scripting attack...