Tampering by prototype polution in DOMPurify
Priority LOW 34CWE-1333Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Partial Red Hat: 8 fixed, 11 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.
Summary
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also possible to use Prototype Pollution to weaken the depth check. This renders dompurify unable to avoid cross site scripting (XSS) attacks. This issue has been addressed in versions 2.5.4 and 3.1.3 of DOMPurify. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00894 59th percentileScored 2026-11-07
Fix Partial DOMPurify (cure53): 2.5.4, 3.1.3dompurify (npm): 2.5.4, 3.1.3Red Hat: 7 advisoriesRed Hat: 8 fixed, 11 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| cure53 | DOMPurify | before 2.5.4; 3.0.0 to before 3.1.3 | 2.5.4, 3.1.3 | Patch available | CNA |
| — | dompurify (npm) | before 2.5.4 | 2.5.4 | Patch available | GHSA-mmhx-hmjr-r674 |
| — | dompurify (npm) | 3.0.0 to before 3.1.3 | 3.1.3 | Patch available | GHSA-mmhx-hmjr-r674 |
- DOMPurify Vendorcure53 Affected before 2.5.4; 3.0.0 to before 3.1.3 Fixed in 2.5.4, 3.1.3 Patch available CNA
- dompurify (npm) Vendor— Affected before 2.5.4 Fixed in 2.5.4 Patch available GHSA-mmhx-hmjr-r674
- dompurify (npm) Vendor— Affected 3.0.0 to before 3.1.3 Fixed in 3.1.3 Patch available GHSA-mmhx-hmjr-r674
Remediation
- Fix · CNA DOMPurify (cure53) Fixed in 2.5.4, 3.1.3
- Fix · GHSA-mmhx-hmjr-r674 dompurify (npm) Fixed in 2.5.4 Advisory →
- Fix · GHSA-mmhx-hmjr-r674 dompurify (npm) Fixed in 3.1.3 Advisory →
Red Hat 7 advisories
- RHSA-2025:4019 Released 2025-04-22 · Red Hat rating ImportantOpenShift Container Platform 4.18.10 bug fix and security update
- Red Hat OpenShift Container Platform 4.18 openshift4/ose-ibm-vpc-block-csi-driver-rhel9, openshift4/ose-monitoring-plugin-rhel9, openshift4/ose-operator-registry-rhel9 +1
- RHSA-2025:0892 Released 2025-02-03 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.18.0 release
- Red Hat OpenShift Dev Spaces 3 devspaces/code-rhel9, devspaces/dashboard-rhel9, devspaces/devspaces-rhel9-operator +1
- RHSA-2024:11381 Released 2024-12-18 · Red Hat rating ModerateRed Hat Advanced Cluster Management 2.11.4 security enhancements and bug fixes
- Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 rhacm2/acm-cluster-permission-rhel9, rhacm2/acm-governance-policy-addon-controller-rhel9, rhacm2/acm-governance-policy-framework-addon-rhel9 +40
Show 4 more Red Hat advisories
- RHSA-2024:10762 Released 2024-12-03 · Red Hat rating ModerateRed Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.4 for RHEL 8 ansible-core-1:2.15.13-1.el8ap, automation-controller-venv-tower-4.5.13-1.el8ap
- Red Hat Ansible Automation Platform 2.4 for RHEL 9 ansible-core-1:2.15.13-1.el9ap, automation-controller-venv-tower-4.5.13-1.el9ap
- RHSA-2024:8014 Released 2024-10-22 · Red Hat rating ImportantNetwork Observability 1.7.0 for OpenShift
- NETOBSERV 1.7 for RHEL 9 network-observability/network-observability-cli-rhel9, network-observability/network-observability-console-plugin-rhel9, network-observability/network-observability-ebpf-agent-rhel9 +3
- RHSA-2024:7706 Released 2024-10-07 · Red Hat rating ModerateRed Hat build of Cryostat security update
- Cryostat 3 on RHEL 8 cryostat-tech-preview/cryostat-db-rhel8, cryostat-tech-preview/cryostat-grafana-dashboard-rhel8, cryostat-tech-preview/cryostat-operator-bundle +6
- RHSA-2024:7324 Released 2024-10-02 · Red Hat rating ModerateLogging for Red Hat OpenShift - 5.9.7
- RHOL 5.9 for RHEL 9 openshift-logging/cluster-logging-operator-bundle, openshift-logging/cluster-logging-rhel9-operator, openshift-logging/eventrouter-rhel9 +9
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Migration Toolkit for Virtualization | Affected | No fix yet |
| Node HealthCheck Operator | Affected | No fix planned: Will not fix |
| Red Hat 3scale API Management Platform 2 | Affected | No fix planned: Will not fix |
| Red Hat Advanced Cluster Security 4 | Affected | No fix yet |
| Red Hat Enterprise Linux 10 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 9 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Data Science (RHODS) | Affected | No fix planned: Will not fix |
| Red Hat OpenShift GitOps | Affected | No fix yet |
| Red Hat OpenShift Virtualization 4 | Affected | No fix planned: Will not fix |
| Red Hat Process Automation 7 | Affected | No fix planned: Will not fix |
| Cryostat 3 on RHEL 8 | Fixed | RHSA-2024:7706 |
| NETOBSERV 1.7 for RHEL 9 | Fixed | RHSA-2024:8014 |
| RHOL 5.9 for RHEL 9 | Fixed | RHSA-2024:7324 |
| Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | Fixed | RHSA-2024:11381 |
| Red Hat Ansible Automation Platform 2.4 for RHEL 8 | Fixed | RHSA-2024:10762 |
| Red Hat Ansible Automation Platform 2.4 for RHEL 9 | Fixed | RHSA-2024:10762 |
| Red Hat OpenShift Container Platform 4.18 | Fixed | RHSA-2025:4019 |
| Red Hat OpenShift Dev Spaces 3 | Fixed | RHSA-2025:0892 |
Not affected: 9 products
- Red Hat Advanced Cluster Security 4
- Red Hat Ansible Automation Platform 2
- Red Hat Ansible Automation Platform 2.4 for RHEL 8
- Red Hat Ansible Automation Platform 2.4 for RHEL 9
- Red Hat Integration Camel K 1
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Container Platform 4.18
- Red Hat OpenShift Data Science (RHODS)
- Red Hat OpenShift Dev Spaces 3
Timeline
- 2026-10-02 Threatist record created from CVE-2024-45801
- 2026-10-03 Alias added: GHSA-mmhx-hmjr-r674
References
Patch 2
Advisory 2
More cure53 Dompurify vulnerabilities
- TI-2026-34986 DOMPurify XSS via `selectedcontent` re-clone CVSS 3.1HIGH 8.2
- TI-2026-36811 DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content CVSS 4.0MEDIUM 6.3
- TI-2026-36614 DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM CVSS 3.1MEDIUM 6.1
- TI-2026-36613 DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks CVSS 3.1MEDIUM 6.1
- TI-2026-29849 DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix) CVSS 4.0MEDIUM 6.0
- TI-2025-19705 Cross-site scripting in cure53 DOMPurify CVSS 3.1MEDIUM 6.1
Sources
- CVE-2024-45801 · CVE Program
- CVE-2024-45801 · NVD
- FIRST EPSS
- GHSA-mmhx-hmjr-r674 · GitHub Advisory Database · CC BY 4.0
- CVE-2024-45801 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences