GHSA-mjjq-c88q-qhr6 Cross-Site Scripting in dompurify
An attacker can execute arbitrary JavaScript in a victim's browser by bypassing sanitization via Mutation XSS in the dompurify library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-mjjq-c88q-qhr6?
GHSA-mjjq-c88q-qhr6 is a cross-site scripting vulnerability in dompurify, published on 3 Sep 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Versions of dompurify prior to 2.0.7 are vulnerable to Cross-Site Scripting (XSS). It is possible to bypass the package sanitization through Mutation XSS, which may allow an attacker to execute arbitrary JavaScript in a victim's browser.
Recommendation
Upgrade to version 2.0.7 or later.
Which versions are affected by GHSA-mjjq-c88q-qhr6?
2 open source packages ship an affected version, including dompurify.
| Package | Affected | Fixed in |
|---|---|---|
dompurify npm | All versions | 2.0.7 |
dompurify npm | All versions | 2.0.7 |
How do I fix GHSA-mjjq-c88q-qhr6?
Upgrade dompurify to 2.0.7 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-mjjq-c88q-qhr6 being exploited?
There is no known exploitation of GHSA-mjjq-c88q-qhr6 in the wild and no public exploit code.