DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3.
CVSS Details
- CVSS 3.1 Base Score: 10
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-grafanaalma-upgrade-grafana-selinux | Oct 24, 2024 | Oct 11, 2024 | |
| Atlassian Jira | atlassian-jira-upgrade-latest | Apr 22, 2026 | Apr 21, 2026 | |
| Debian | debian-upgrade-cactidebian-upgrade-node-dompurify | Oct 15, 2024 | Oct 11, 2024 | |
| Oracle_linux | — | oracle-linux-upgrade-grafanaoracle-linux-upgrade-grafana-selinux | Nov 11, 2024 | Oct 11, 2024 |
| Redhat_linux | redhat-upgrade-grafanaredhat-upgrade-grafana-debuginforedhat-upgrade-grafana-debugsourceredhat-upgrade-grafana-selinux | Oct 23, 2024 | Oct 11, 2024 | |
| Rocky_linux | rocky-upgrade-grafanarocky-upgrade-grafana-debuginforocky-upgrade-grafana-debugsourcerocky-upgrade-grafana-selinux | Nov 4, 2024 | Oct 11, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub