CVE-2024-47875 DOMPurify nesting-based mXSS
An attacker can execute arbitrary JavaScript via nesting-based mXSS in DOMPurify, requiring an upgrade to patched versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-47875?
CVE-2024-47875 is a critical cross-site scripting vulnerability in cure53 DOMPurify, published on 11 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3.
Weakness: CWE-79
Which versions are affected by CVE-2024-47875?
4 open source packages ship an affected version, including dompurify. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
dompurify npm | All versions | 2.5.0 |
dompurify npm | All versions | 2.5.0 |
dompurify npm | From 3.0.0 | 3.1.3 |
dompurify npm | From 3.0.0 | 3.1.3 |
Products include Cure53 Dompurify.
How do I fix CVE-2024-47875?
Upgrade dompurify to a fixed version for your release line: 2.5.0 or 3.1.3.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-47875 being exploited?
There is no known exploitation of CVE-2024-47875 in the wild and no public exploit code.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in cure53 DOMPurify
- CVE-2024-48910 DOMPurify vulnerable to tampering by prototype polution
- CVE-2026-47423 DOMPurify XSS via `selectedcontent` re-clone
- CVE-2024-45801 Tampering by prototype polution in DOMPurify
- CVE-2026-49978 DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content
- CVE-2026-49458 DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks
Sources
Also known as CLSA-2026-1792760535, DEBIAN-CVE-2024-47875, DSA-5790-1, GHSA-gx9m-whjm-85jf, MINI-cgwm-8wg3-6php, UBUNTU-CVE-2024-47875.