Read the docs
TI-2024-32129 Aliases CVE-2024-47875GHSA-gx9m-whjm-85jf

DOMPurify nesting-based mXSS

Priority MEDIUM 45CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · High · High
Fix status
Partial Red Hat: 10 fixed, 8 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.

Summary

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01134 66th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial DOMPurify (cure53): 2.5.0, 3.1.3dompurify (npm): 2.5.0, 3.1.3Red Hat: 11 advisoriesRed Hat: 10 fixed, 8 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
cure53DOMPurifybefore 2.5.0; before 3.1.32.5.0, 3.1.3Patch availableCNA
—dompurify (npm)before 2.5.02.5.0Patch availableGHSA-gx9m-whjm-85jf
—dompurify (npm)3.0.0 to before 3.1.33.1.3Patch availableGHSA-gx9m-whjm-85jf
  • DOMPurify Vendorcure53 Affected before 2.5.0; before 3.1.3 Fixed in 2.5.0, 3.1.3 Patch available CNA
  • dompurify (npm) Vendor— Affected before 2.5.0 Fixed in 2.5.0 Patch available GHSA-gx9m-whjm-85jf
  • dompurify (npm) Vendor— Affected 3.0.0 to before 3.1.3 Fixed in 3.1.3 Patch available GHSA-gx9m-whjm-85jf

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cure53:dompurify:*:*:*:*:*:*:*:*before 2.5.0; 3.0.0 to before 3.1.3Vulnerablecure53
  • cpe:2.3:a:cure53:dompurify:*:*:*:*:*:*:*:* Versions before 2.5.0; 3.0.0 to before 3.1.3 Vulnerable ·cure53

Remediation

  • Fix · CNA DOMPurify (cure53) Fixed in 2.5.0, 3.1.3
  • Fix · GHSA-gx9m-whjm-85jf dompurify (npm) Fixed in 2.5.0 Advisory →
  • Fix · GHSA-gx9m-whjm-85jf dompurify (npm) Fixed in 3.1.3 Advisory →

Red Hat 11 advisories

  • RHSA-2024:10988 Released 2025-01-15 · Red Hat rating Important
    Logging for Red Hat OpenShift - 5.6.27
    • RHOL 5.6 for RHEL 8 openshift-logging/cluster-logging-operator-bundle, openshift-logging/cluster-logging-rhel8-operator, openshift-logging/elasticsearch-operator-bundle +15
  • RHSA-2025:0329 Released 2025-01-15 · Red Hat rating Important
    Logging for Red Hat OpenShift - 5.8.16
    • RHOL 5.8 for RHEL 9 openshift-logging/cluster-logging-operator-bundle, openshift-logging/cluster-logging-rhel9-operator, openshift-logging/elasticsearch-operator-bundle +14
  • RHSA-2024:10236 Released 2024-11-25 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.17.0 release
    • Red Hat OpenShift Dev Spaces 3 devspaces/code-rhel8, devspaces/dashboard-rhel8, devspaces/udi-rhel8
Show 8 more Red Hat advisories
  • RHSA-2024:9620 Released 2024-11-20 · Red Hat rating Important
    OpenShift Container Platform 4.14.41 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 openshift4/ose-console, openshift4/ose-monitoring-plugin-rhel8, rhcos
  • RHSA-2024:9629 Released 2024-11-14 · Red Hat rating Important
    Red Hat OpenShift Service Mesh Containers for 2.5.6
    • RHOSSM 2.5 for RHEL 8 openshift-service-mesh/grafana-rhel8, openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/istio-must-gather-rhel8 +5
  • RHSA-2024:8991 Released 2024-11-13 · Red Hat rating Important
    OpenShift Container Platform 4.15.38 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 openshift4/ose-agent-installer-api-server-rhel8, openshift4/ose-console, openshift4/ose-monitoring-plugin-rhel8 +1
  • RHSA-2024:8981 Released 2024-11-13 · Red Hat rating Important
    OpenShift Container Platform 4.17.4 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 openshift4/ose-console-rhel9, openshift4/ose-monitoring-plugin-rhel9
  • RHSA-2024:9473 Released 2024-11-12 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream (v. 9) grafana-10.2.6-7.el9_5, grafana-selinux-10.2.6-7.el9_5
  • RHSA-2024:8683 Released 2024-11-06 · Red Hat rating Important
    OpenShift Container Platform 4.16.20 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 openshift4/ose-monitoring-plugin-rhel9
  • RHSA-2024:8678 Released 2024-10-30 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream (v. 9) grafana-9.2.10-19.el9_4, grafana-selinux-9.2.10-19.el9_4
  • RHSA-2024:8327 Released 2024-10-22 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream (v. 8) grafana-9.2.10-20.el8_10, grafana-selinux-9.2.10-20.el8_10

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Node HealthCheck OperatorAffectedNo fix planned: Will not fix
OpenShift PipelinesAffectedNo fix yet
Red Hat 3scale API Management Platform 2AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix planned: Will not fix
Red Hat OpenShift Virtualization 4AffectedNo fix yet
RHOL 5.6 for RHEL 8Fixed RHSA-2024:10988
RHOL 5.8 for RHEL 9Fixed RHSA-2025:0329
RHOSSM 2.5 for RHEL 8Fixed RHSA-2024:9629
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2024:8327
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2024:8678, RHSA-2024:9473
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2024:9620
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2024:8991
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2024:8683
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2024:8981
Red Hat OpenShift Dev Spaces 3Fixed RHSA-2024:10236
Not affected: 14 products
  • Migration Toolkit for Virtualization
  • Multicluster Engine for Kubernetes
  • Network Observability Operator
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Security 4
  • Red Hat Ansible Automation Platform 2
  • Red Hat Developer Hub 1
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Container Platform 4.14
  • Red Hat OpenShift Container Platform 4.15
  • Red Hat OpenShift Container Platform 4.16
  • Red Hat OpenShift Container Platform 4.17
  • Red Hat OpenShift Dev Spaces 3
  • Red Hat OpenShift Virtualization 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-47875
  2. 2026-10-03 Alias added: GHSA-gx9m-whjm-85jf
  3. 2026-10-27 Affected versions changed · Red Hat
  4. 2026-11-06 Fix available: RHSA-2024:10988 · Red Hat

References

Exploit 1

Patch 2

Advisory 1

Other 4

  • TI-2026-34986 DOMPurify XSS via `selectedcontent` re-clone CVSS 3.1HIGH 8.2
  • TI-2026-36811 DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content CVSS 4.0MEDIUM 6.3
  • TI-2026-36614 DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM CVSS 3.1MEDIUM 6.1
  • TI-2026-36613 DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks CVSS 3.1MEDIUM 6.1
  • TI-2026-29849 DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix) CVSS 4.0MEDIUM 6.0
  • TI-2025-19705 Cross-site scripting in cure53 DOMPurify CVSS 3.1MEDIUM 6.1
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences