Read the docs
TI-2024-32607 Aliases CVE-2024-48910GHSA-p3vf-v8qc-cwcr

DOMPurify vulnerable to tampering by prototype polution

Priority MEDIUM 51CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 15 fixed, 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability is fixed in 2.4.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01151 67th percentileScored 2026-11-07
Fix Partial DOMPurify (cure53): 2.4.2dompurify (npm): 2.4.2Red Hat: 20 advisoriesRed Hat: 15 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
cure53DOMPurifybefore 2.4.22.4.2Patch availableCNA
—dompurify (npm)before 2.4.22.4.2Patch availableGHSA-p3vf-v8qc-cwcr
  • DOMPurify Vendorcure53 Affected before 2.4.2 Fixed in 2.4.2 Patch available CNA
  • dompurify (npm) Vendor— Affected before 2.4.2 Fixed in 2.4.2 Patch available GHSA-p3vf-v8qc-cwcr

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cure53:dompurify:*:*:*:*:*:*:*:*before 2.4.2Vulnerablecure53
  • cpe:2.3:a:cure53:dompurify:*:*:*:*:*:*:*:* Versions before 2.4.2 Vulnerable ·cure53

Remediation

  • Fix · CNA DOMPurify (cure53) Fixed in 2.4.2
  • Fix · GHSA-p3vf-v8qc-cwcr dompurify (npm) Fixed in 2.4.2 Advisory →

Red Hat 20 advisories

  • RHSA-2025:22284 Released 2025-12-05 · Red Hat rating Important
    OpenShift Container Platform 4.13.62 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 registry.redhat.io/openshift4/ose-console
  • RHSA-2025:19895 Released 2025-11-13 · Red Hat rating Important
    OpenShift Container Platform 4.12.82 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 registry.redhat.io/openshift4/ose-console
  • RHSA-2025:19306 Released 2025-11-06 · Red Hat rating Important
    OpenShift Container Platform 4.15.59 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 registry.redhat.io/openshift4/ose-console, registry.redhat.io/openshift4/ose-multus-admission-controller-rhel9, registry.redhat.io/openshift4/ose-oauth-proxy-rhel9
Show 17 more Red Hat advisories
  • RHSA-2025:19314 Released 2025-11-05 · Red Hat rating Important
    OpenShift Container Platform 4.17.43 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/ose-console-rhel9
  • RHSA-2025:19003 Released 2025-10-30 · Red Hat rating Important
    OpenShift Container Platform 4.20.1 bug fix and security update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9 +47
  • RHSA-2025:19058 Released 2025-10-30 · Red Hat rating Important
    OpenShift Container Platform 4.14.58 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 registry.redhat.io/openshift4/ose-console
  • RHSA-2025:19017 Released 2025-10-29 · Red Hat rating Important
    OpenShift Container Platform 4.16.51 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/ose-console-rhel9
  • RHSA-2025:19047 Released 2025-10-29 · Red Hat rating Important
    OpenShift Container Platform 4.18.27 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/ose-console-rhel9
  • RHSA-2025:18233 Released 2025-10-21 · Red Hat rating Important
    OpenShift Container Platform 4.19.17 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/ose-console-rhel9
  • RHSA-2025:8551 Released 2025-06-04 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.14.18 Bug Fix Update
    • RHODF 4.14 for RHEL 9 odf4/ocs-client-console-rhel9, odf4/odf-console-rhel9, odf4/odf-multicluster-console-rhel9 +1
  • RHSA-2025:8544 Released 2025-06-04 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.15.14 Bug Fix Update
    • RHODF 4.15 for RHEL 9 odf4/mcg-rhel9-operator, odf4/ocs-client-console-rhel9, odf4/odf-console-rhel9 +2
  • RHSA-2024:6122 Released 2025-02-25 · Red Hat rating Important
    OpenShift Container Platform 4.18.1 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 openshift4/aws-kms-encryption-provider-rhel9, openshift4/azure-kms-encryption-provider-rhel9, openshift4/azure-service-rhel9-operator +47
  • RHSA-2024:6121 Released 2025-02-25 · Red Hat rating Important
    OpenShift Container Platform 4.18.1 security and extras update
    • Red Hat OpenShift Container Platform 4.18 openshift4/ingress-node-firewall-rhel9, openshift4/ingress-node-firewall-rhel9-operator, openshift4/kube-compare-artifacts-rhel9 +47
  • RHSA-2025:0875 Released 2025-02-05 · Red Hat rating Important
    OpenShift Container Platform 4.17.15 security and extras update
    • Red Hat OpenShift Container Platform 4.17 openshift4/nmstate-console-plugin-rhel9, openshift4/ose-ansible-rhel9-operator, openshift4/ose-helm-rhel9-operator +2
  • RHSA-2025:0654 Released 2025-01-28 · Red Hat rating Important
    OpenShift Container Platform 4.17.14 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 openshift4/oc-mirror-plugin-rhel9, openshift4/ose-agent-installer-api-server-rhel9, openshift4/ose-baremetal-cluster-api-controllers-rhel9 +6
  • RHSA-2025:0082 Released 2025-01-08 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.16.5 Bug Fix Update
    • RHODF 4.16 for RHEL 9 odf4/cephcsi-rhel9, odf4/ocs-client-console-rhel9, odf4/odf-console-rhel9 +1
  • RHSA-2025:0079 Released 2025-01-08 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.17.2 Bug Fix Update
    • RHODF 4.17 for RHEL 9 odf4/ocs-client-console-rhel9, odf4/odf-console-rhel9, odf4/odf-multicluster-console-rhel9
  • RHSA-2024:10186 Released 2024-11-22 · Red Hat rating Important
    ACS 4.5 enhancement update
    • RHACS 4.5 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-rhel8-operator, advanced-cluster-security/rhacs-roxctl-rhel8 +3
  • RHSA-2024:9620 Released 2024-11-20 · Red Hat rating Important
    OpenShift Container Platform 4.14.41 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 openshift4/ose-console, openshift4/ose-monitoring-plugin-rhel8, rhcos
  • RHSA-2024:9583 Released 2024-11-13 · Red Hat rating Important
    ACS 4.4 enhancement update
    • RHACS 4.4 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-rhel8-operator, advanced-cluster-security/rhacs-roxctl-rhel8 +3

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Node HealthCheck OperatorAffectedNo fix planned: Will not fix
Red Hat OpenShift Virtualization 4AffectedNo fix yet
RHACS 4.4 for RHEL 8Fixed RHSA-2024:9583
RHACS 4.5 for RHEL 8Fixed RHSA-2024:10186
RHODF 4.14 for RHEL 9Fixed RHSA-2025:8551
RHODF 4.15 for RHEL 9Fixed RHSA-2025:8544
RHODF 4.16 for RHEL 9Fixed RHSA-2025:0082
RHODF 4.17 for RHEL 9Fixed RHSA-2025:0079
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2025:19895
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2025:22284
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2024:9620, RHSA-2025:19058
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2025:19306
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2025:19017
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2025:0654, RHSA-2025:0875, RHSA-2025:19314
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2024:6121, RHSA-2024:6122, RHSA-2025:19047
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2025:18233
Red Hat OpenShift Container Platform 4.20Fixed RHSA-2025:19003
Not affected: 33 products
  • Logging Subsystem for Red Hat OpenShift
  • Migration Toolkit for Virtualization
  • Multicluster Engine for Kubernetes
  • Network Observability Operator
  • OpenShift Pipelines
  • OpenShift Service Mesh 2
  • RHACS 4.4 for RHEL 8
  • RHACS 4.5 for RHEL 8
  • RHODF 4.14 for RHEL 9
  • RHODF 4.15 for RHEL 9
  • RHODF 4.16 for RHEL 9
  • RHODF 4.17 for RHEL 9
  • Red Hat 3scale API Management Platform 2
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Security 4
  • Red Hat Ansible Automation Platform 2
  • Red Hat Developer Hub 1
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Container Platform 4.12
  • Red Hat OpenShift Container Platform 4.13
  • Red Hat OpenShift Container Platform 4.14
  • Red Hat OpenShift Container Platform 4.15
  • Red Hat OpenShift Container Platform 4.16
  • Red Hat OpenShift Container Platform 4.17
  • Red Hat OpenShift Container Platform 4.18
  • Red Hat OpenShift Container Platform 4.19
  • Red Hat OpenShift Container Platform 4.20
  • Red Hat OpenShift Data Science (RHODS)
  • Red Hat OpenShift Dev Spaces
  • Red Hat OpenShift GitOps

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-48910
  2. 2026-10-03 Alias added: GHSA-p3vf-v8qc-cwcr
  3. 2026-10-27 Affected versions changed · Red Hat

References

Patch 1

Advisory 2

Other 2

  • TI-2026-34986 DOMPurify XSS via `selectedcontent` re-clone CVSS 3.1HIGH 8.2
  • TI-2026-36811 DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content CVSS 4.0MEDIUM 6.3
  • TI-2026-36614 DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM CVSS 3.1MEDIUM 6.1
  • TI-2026-36613 DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks CVSS 3.1MEDIUM 6.1
  • TI-2026-29849 DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix) CVSS 4.0MEDIUM 6.0
  • TI-2025-19705 Cross-site scripting in cure53 DOMPurify CVSS 3.1MEDIUM 6.1
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences