CVE-2024-47875 json
DOMPurify nesting-based mXSS
published 2024-10-11 2 y ago modified 2026-09-10 1 mo ago also EUVD-2024-3049 , GHSA-gx9m-whjm-85jf
- cvss
- 10.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.1%
- EPSS 1.1% chance of exploitation in 30 days, percentile 66%
- public exploits
- 0
- none known
Summary
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3.
Patch / fix
- npm dompurify 2.5.0, 3.1.3
- cure53 dompurify 2.5.0, 3.1.3
- cacti Debian 12 1.2.24+ds1-1+deb12u2
- cacti Debian 14, Debian 13 1.2.26+ds1-1
- node-dompurify Debian 12 2.4.1+dfsg+~2.4.0-2
- node-dompurify Debian 14, Debian 13 3.1.6+dfsg+~3.0.5-1
debian advisories DEBIAN-CVE-2024-47875
- grafana RHEL 9 10.2.6-7.el9_5
- grafana-selinux RHEL 9 10.2.6-7.el9_5
- grafana RHEL 9 9.2.10-19.el9_4
- grafana-selinux RHEL 9 9.2.10-19.el9_4
- grafana RHEL 8 9.2.10-20.el8_10
- grafana-selinux RHEL 8 9.2.10-20.el8_10
red hat advisories RHSA-2024:9473RHSA-2024:8678RHSA-2024:8327
- velociraptor openSUSE Tumbleweed 0.7.0.4.git142.862ef23-1.1
opensuse advisories openSUSE-SU-2025:14663-1
- grafana AlmaLinux 9 10.2.6-7.el9_5
- grafana-selinux AlmaLinux 9 10.2.6-7.el9_5
- grafana AlmaLinux 9 9.2.10-19.el9_4
- grafana-selinux AlmaLinux 9 9.2.10-19.el9_4
- grafana AlmaLinux 8 9.2.10-20.el8_10
- grafana-selinux AlmaLinux 8 9.2.10-20.el8_10
almalinux advisories ALSA-2024:9473ALSA-2024:8678ALSA-2024:8327
- grafana Rocky Linux 9 10.2.6-7.el9_5
- grafana Rocky Linux 9 9.2.10-19.el9_4
- grafana Rocky Linux 8 9.2.10-20.el8_10
rocky linux advisories RLSA-2024:9473RLSA-2024:8678RLSA-2024:8327
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2024-47875 updated cvss 8.0
dompurify: nesting-based mutation XSS vulnerability
-
Red Hat Node HealthCheck Operator workload-availability/node-remediation-console-rhel8affected: workaround, no fix planned “Will not fix”
-
Red Hat OpenShift Pipelines openshift-pipelines/pipelines-console-plugin-rhel8affected: workaround, no fix available
-
Red Hat 3scale API Management Platform 2 3scale-amp2/system-rhel7affected: workaround, no fix planned “Will not fix”
-
Red Hat Enterprise Linux 10 grafanaaffected: workaround, no fix available
-
Red Hat OpenShift AI (RHOAI) odh-dashboard-containeraffected: workaround, no fix planned “Will not fix”
-
Red Hat OpenShift Container Platform 4 openshift4/ose-console, openshift4/nmstate-console-plugin-rhel9, openshift4/ose-networking-console-plugin-rhel9affected: workaround, no fix available, no fix planned “Will not fix”
-
Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/console-plugin-rhel8, openshift-gitops-argocd-rhel9-container, openshift-gitops-1/gitops-operator-bundleaffected: workaround, no fix planned “Will not fix”
-
Red Hat OpenShift Virtualization 4 container-native-virtualization/kubevirt-console-pluginaffected: workaround, no fix available
show 11 moreshow fewer
-
Red Hat Enterprise Linux AppStream (v. 8) grafana 9.2.10-20.el8_10, grafana-selinux 9.2.10-20.el8_10fixed: vendor fix RHSA-2024:8327
-
Red Hat Enterprise Linux AppStream (v. 9) grafana 10.2.6-7.el9_5, grafana 9.2.10-19.el9_4, grafana-selinux 10.2.6-7.el9_5, grafana-selinux 9.2.10-19.el9_4fixed: vendor fix RHSA-2024:8678
-
Red Hat OpenShift Container Platform 4.14 openshift4/ose-monitoring-plugin-rhel8 v4.14.0-202411130434.p0.gb57ebe7.assembly.stream.el8fixed: vendor fix RHSA-2024:9620
-
Red Hat OpenShift Container Platform 4.15 openshift4/ose-monitoring-plugin-rhel8 v4.15.0-202411060036.p0.ge40b085.assembly.stream.el8fixed: vendor fix RHSA-2024:8991
-
Red Hat OpenShift Container Platform 4.16 openshift4/ose-monitoring-plugin-rhel9 v4.16.0-202410300036.p0.g442ccd1.assembly.stream.el9fixed: vendor fix RHSA-2024:8683
-
Red Hat OpenShift Container Platform 4.17 openshift4/ose-monitoring-plugin-rhel9 v4.17.0-202410300235.p0.g9c9c0a0.assembly.stream.el9fixed: vendor fix RHSA-2024:8981
-
Red Hat OpenShift Dev Spaces 3 devspaces/code-rhel8 3.17-19fixed: vendor fix RHSA-2024:10236
-
Red Hat RHOL 5.6 for RHEL 8 openshift-logging/kibana6-rhel8 v6.8.1-472, openshift-logging/vector-rhel8 v0.21.0-143, openshift-logging/fluentd-rhel8 v1.14.6-232, openshift-logging/eventrouter-rhel8 v0.4.0-333, openshift-logging/logging-loki-rhel8 v3.2.0-23, openshift-logging/loki-rhel8-operator v5.6.27-6, +12 morefixed: vendor fix RHSA-2024:10988
-
Red Hat RHOL 5.8 for RHEL 9 openshift-logging/fluentd-rhel9 v5.8.16-2, openshift-logging/vector-rhel9 v0.28.1-83, openshift-logging/eventrouter-rhel9 v0.4.0-328, openshift-logging/logging-loki-rhel9 v3.2.1-22, openshift-logging/loki-rhel9-operator v5.8.16-4, openshift-logging/opa-openshift-rhel9 v0.1.0-326, +11 morefixed: vendor fix RHSA-2025:0329
-
Red Hat RHOSSM 2.5 for RHEL 8 openshift-service-mesh/pilot-rhel8 2.5.6-3, openshift-service-mesh/grafana-rhel8 2.5.6-2, openshift-service-mesh/kiali-rhel8 1.73.16-2, openshift-service-mesh/proxyv2-rhel8 2.5.6-4, openshift-service-mesh/istio-cni-rhel8 2.5.6-3, openshift-service-mesh/ratelimit-rhel8 2.5.6-2, +2 morefixed: vendor fix RHSA-2024:9629
-
Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-console-plugin-rhel9 Red Hat Multicluster Engine for Kubernetes multicluster-engine/multicluster-engine-console-mce-rhel9 Red Hat Network Observability Operator network-observability/network-observability-console-plugin-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/console-rhel8 Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-roxctl-rhel8, advanced-cluster-security/rhacs-rhel8-operator, advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-scanner-v4-rhel8, advanced-cluster-security/rhacs-scanner-v4-db-rhel8 Red Hat Ansible Automation Platform 2 automation-gateway, automation-controller, automation-eda-controllernot affected: vulnerable code not present
+8 more productsfewer
Red Hat Developer Hub 1 rhdh/rhdh-hub-rhel9, rhdh-operator-container Red Hat OpenShift AI (RHOAI) odh-operator-container Red Hat OpenShift Container Platform 4.14 rhcos 414.92.202411130444-0, openshift4/ose-cli v4.14.0-202411130434.p0.g44b3ac2.assembly.stream.el8, openshift4/ose-pod v4.14.0-202411130434.p0.g03a907c.assembly.stream.el8, openshift4/ose-tests v4.14.0-202411130434.p0.g2c640ec.assembly.stream.el8, openshift4/ose-console v4.14.0-202411131205.p0.g839a801.assembly.stream.el8, openshift4/ose-coredns v4.14.0-202411130434.p0.gfdd6037.assembly.stream.el8, +188 more Red Hat OpenShift Container Platform 4.15 rhcos 415.92.202411050056-0, openshift4/ose-cli v4.15.0-202411060036.p0.g8231637.assembly.stream.el8, openshift4/ose-tests v4.15.0-202411060036.p0.g7db90dc.assembly.stream.el8, openshift4/ose-console v4.15.0-202411060036.p0.gd8360d4.assembly.stream.el8, openshift4/ose-deployer v4.15.0-202411060036.p0.g8231637.assembly.stream.el8, openshift4/ose-installer v4.15.0-202411060036.p0.g4caaa38.assembly.stream.el8, +187 more Red Hat OpenShift Container Platform 4.16 rhcos 416.94.202410292028-0, openshift4/ose-cli-rhel9 v4.16.0-202410242205.p0.gcf533b5.assembly.stream.el9, openshift4/ose-pod-rhel9 v4.16.0-202410242205.p0.g5865c5b.assembly.stream.el9, openshift4/ose-sdn-rhel9 v4.16.0-202410290036.p0.ge4a5322.assembly.stream.el9, openshift4/ose-etcd-rhel9 v4.16.0-202410242205.p0.g16202ec.assembly.stream.el9, openshift4/ose-tests-rhel9 v4.16.0-202410300036.p0.g06403d4.assembly.stream.el9, +185 more Red Hat OpenShift Container Platform 4.17 rhcos 417.94.202411050056-0, openshift4/frr-rhel9 v4.17.0-202410251036.p0.g377d02f.assembly.stream.el9, openshift4/ose-cli-rhel9 v4.17.0-202410241236.p0.gdde885f.assembly.stream.el9, openshift4/ose-pod-rhel9 v4.17.0-202410241236.p0.g6816ea6.assembly.stream.el9, openshift4/ose-etcd-rhel9 v4.17.0-202410241236.p0.gc82057d.assembly.stream.el9, openshift4/ose-tests-rhel9 v4.17.0-202411052236.p0.gb231f76.assembly.stream.el9, +183 more Red Hat OpenShift Dev Spaces 3 devspaces/udi-rhel8 3.17-9, devspaces/idea-rhel8 3.17-4, devspaces/server-rhel8 3.17-9, devspaces/traefik-rhel8 3.17-4, devspaces/configbump-rhel8 3.17-4, devspaces/dashboard-rhel8 3.17-25, +5 more Red Hat OpenShift Virtualization 4 container-native-virtualization/kubevirt-console-plugin-rhel9
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
cisa ICSA-26-043-03 updated cvss 10.0
Siemens COMOS
-
Siemens COMOS V10.4 < 10.4.5affected: fixed in V10.4.5 support.sw.siemens.com
-
Siemens COMOS V10.5 < 10.5.2affected: fixed in V10.5.2 support.sw.siemens.com
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
1.13% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/cure53/DOMPurify/security/advisories/GHSA-gx9m-whjm-85jf referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H |
| GitHub | 3.1 | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | dompurify | <2.5.0 >=3.0.0, <3.1.3 |
2.5.0 3.1.3 |
Affected products
- cure53 DOMPurify
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/cure53/DOMPurify/commit/0ef5e537a514f904b6aa1d7ad9e749e365d7185f
web, patch
-
github.com
/cure53/DOMPurify/commit/6ea80cd8b47640c20f2f230c7920b1f4ce4fdf7a
web, patch
-
github.com
/cure53/DOMPurify/security/advisories/GHSA-gx9m-whjm-85jf
web, exploit, third-party-advisory
-
github.com
/cure53/DOMPurify/blob/0ef5e537a514f904b6aa1d7ad9e749e365d7185f/test/test-suite.js#L2098
web, product
-
seclists.org
/fulldisclosure/2025/Apr/14
web
-
lists.debian.org
/debian-lts-announce/2025/02/msg00010.html
web
-
nvd.nist.gov
/vuln/detail/CVE-2024-47875
advisory
-
github.com
/cure53/DOMPurify
package
Sources
- CVE List CVE-2024-47875
- GitHub Advisory GHSA-gx9m-whjm-85jf
- NVD CVE-2024-47875
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.