Attestkeep
Idioma: Español
Registrarse

Vulnerabilidades / CVE-2024-48910

crítica

CVE-2024-48910

dompurify: DOMPurify vulnerable to tampering by prototype pollution

Publicada Modificada CWE 1321
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.

Severidad por fuente

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Red Hat8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, GHSA. Más baja según Red Hat (alta).

Descripción

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability is fixed in 2.4.2.

Paquetes afectados y versiones corregidas

FuentePaqueteCorregido en
npm::GitHub Security Advisory npmdompurify2.4.2
debian 11cacti1.2.16+ds1-2+deb11u5
debian 12cacti, node-dompurify1.2.24+ds1-1+deb12u2 y 1 más
debian 13cacti, node-dompurify1.2.26+ds1-1 y 1 más
debian 14cacti, node-dompurify1.2.26+ds1-1 y 1 más
echocacti, node-dompurify1.2.24+ds1-1+deb12u2 y 1 más
rapidfort debian 12node-dompurify0:2.4.1+dfsg+~2.4.0-2+deb12u1
rapidfort debian 13node-dompurify0:2.4.1+dfsg+~2.4.0-2+deb12u1
seal npm::Seal Security Database@seal-security/dompurify, dompurify2.0.12-sp4
Mostrar las 14 entradas de 9 fuentes
FuentePaqueteCorregido en
npm::GitHub Security Advisory npmdompurify2.4.2
debian 11cacti1.2.16+ds1-2+deb11u5
debian 12cacti1.2.24+ds1-1+deb12u2
debian 12node-dompurify2.4.1+dfsg+~2.4.0-2+deb12u1
debian 13cacti1.2.26+ds1-1
debian 13node-dompurify3.0.9+dfsg+~3.0.5-1
debian 14cacti1.2.26+ds1-1
debian 14node-dompurify3.0.9+dfsg+~3.0.5-1
echocacti1.2.24+ds1-1+deb12u2
echonode-dompurify2.4.1+dfsg+~2.4.0-2+deb12u1
rapidfort debian 12node-dompurify0:2.4.1+dfsg+~2.4.0-2+deb12u1
rapidfort debian 13node-dompurify0:2.4.1+dfsg+~2.4.0-2+deb12u1
seal npm::Seal Security Database@seal-security/dompurify2.0.12-sp4
seal npm::Seal Security Databasedompurify2.0.12-sp4

Referencias

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.