critical
9.1
CVE-2024-48910 json
DOMPurify vulnerable to tampering by prototype polution
published 2024-10-31 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-3092 , GHSA-p3vf-v8qc-cwcr
- cvss
- 9.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.2%
- EPSS 1.2% chance of exploitation in 30 days, percentile 67%
- public exploits
- 0
- none known
Summary
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability is fixed in 2.4.2.
Patch / fix
- npm dompurify 2.4.2
- cure53 DOMPurify 2.4.2
- cacti Debian 12 1.2.24+ds1-1+deb12u2
- cacti Debian 14, Debian 13 1.2.26+ds1-1
- node-dompurify Debian 12 2.4.1+dfsg+~2.4.0-2+deb12u1
- node-dompurify Debian 14, Debian 13 3.0.9+dfsg+~3.0.5-1
debian advisories DEBIAN-CVE-2024-48910
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2024-48910 updated cvss 8.2
dompurify: DOMPurify vulnerable to tampering by prototype pollution
-
Red Hat Node HealthCheck Operator workload-availability/node-remediation-console-rhel8affected: workaround, no fix planned “Will not fix”
-
Red Hat OpenShift Virtualization 4 container-native-virtualization/kubevirt-console-plugin, container-native-virtualization/kubevirt-console-plugin-rhel9affected: workaround, no fix available
-
Red Hat OpenShift Container Platform 4.12 openshift4 openshift-enterprise-console-container-v4.12.0-202511032222.p2.ge7f3c04.assembly.stream.el8fixed: vendor fix RHSA-2025:19895
-
Red Hat OpenShift Container Platform 4.13 openshift4 openshift-enterprise-console-container-v4.13.0-202511250107.p2.gb6b545c.assembly.stream.el8fixed: vendor fix RHSA-2025:22284
-
Red Hat OpenShift Container Platform 4.14 openshift4/ose-monitoring-plugin-rhel8 v4.14.0-202411130434.p0.gb57ebe7.assembly.stream.el8, openshift4 openshift-enterprise-console-container-v4.14.0-202510211320.p2.g0682746.assembly.stream.el8fixed: vendor fix RHSA-2024:9620
-
Red Hat OpenShift Container Platform 4.15 openshift4 openshift-enterprise-console-container-v4.15.0-202510281322.p2.g57d3637.assembly.stream.el8fixed: vendor fix RHSA-2025:19306
-
Red Hat OpenShift Container Platform 4.16 openshift4 openshift-enterprise-console-container-v4.16.0-202510211319.p2.gfbca50e.assembly.stream.el9fixed: vendor fix RHSA-2025:19017
-
Red Hat OpenShift Container Platform 4.17 openshift4/nmstate-console-plugin-rhel9 v4.17.0-202501301204.p0.gcffdc60.assembly.stream.el9, openshift4/ose-networking-console-plugin-rhel9 v4.17.0-202501150934.p0.g0244dff.assembly.stream.el9, openshift4 openshift-enterprise-console-container-v4.17.0-202510292120.p2.g03b6e05.assembly.stream.el9fixed: vendor fix RHSA-2025:0875
show 10 moreshow fewer
-
Red Hat OpenShift Container Platform 4.18 rhcos 418.94.202502100215-0, openshift4/frr-rhel9 v4.18.0-202502041302.p0.g1ad8f2e.assembly.stream.el9, openshift4/metallb-rhel9 v4.18.0-202502041632.p0.gdcee704.assembly.stream.el9, openshift4/ose-cli-rhel9 v4.18.0-202502040032.p0.ga50d4c0.assembly.stream.el9, openshift4/ose-pod-rhel9 v4.18.0-202502051032.p0.gacb9630.assembly.stream.el9, openshift4/ose-ptp-rhel9 v4.18.0-202501230001.p0.gcc2e8c8.assembly.stream.el9, +238 morefixed: vendor fix RHSA-2024:6122
-
Red Hat OpenShift Container Platform 4.19 openshift4 openshift-enterprise-console-container-v4.19.0-202510142112.p2.g9c496c6.assembly.stream.el9fixed: vendor fix RHSA-2025:18233
-
Red Hat OpenShift Container Platform 4.20 openshift4 openshift-enterprise-console-container-v4.20.0-202510211040.p2.gc26aad4.assembly.stream.el9fixed: vendor fix RHSA-2025:19003
-
Red Hat RHACS 4.4 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8 4.4.6-2fixed: vendor fix RHSA-2024:9583
-
Red Hat RHACS 4.5 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8 4.5.5-3fixed: vendor fix RHSA-2024:10186
-
Red Hat RHODF 4.14 for RHEL 9 odf4/odf-console-rhel9 v4.14.18-3, odf4/ocs-client-console-rhel9 v4.14.18-2, odf4/odf-multicluster-console-rhel9 v4.14.18-2fixed: vendor fix RHSA-2025:8551
-
Red Hat RHODF 4.15 for RHEL 9 odf4/odf-console-rhel9 v4.15.14-2, odf4/ocs-client-console-rhel9 v4.15.14-2, odf4/odf-multicluster-console-rhel9 v4.15.14-2fixed: vendor fix RHSA-2025:8544
-
Red Hat RHODF 4.16 for RHEL 9 odf4/odf-console-rhel9 v4.16.5-2, odf4/ocs-client-console-rhel9 v4.16.5-2, odf4/odf-multicluster-console-rhel9 v4.16.5-2fixed: vendor fix RHSA-2025:0082
-
Red Hat RHODF 4.17 for RHEL 9 odf4/odf-console-rhel9 v4.17.2-1, odf4/ocs-client-console-rhel9 v4.17.2-1, odf4/odf-multicluster-console-rhel9 v4.17.2-1fixed: vendor fix RHSA-2025:0079
-
Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/logging-view-plugin-rhel9 Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-console-plugin-rhel9 Red Hat Multicluster Engine for Kubernetes multicluster-engine/multicluster-engine-console-mce-rhel9 Red Hat Network Observability Operator network-observability/network-observability-console-plugin-rhel9 Red Hat OpenShift Pipelines openshift-pipelines/pipelines-console-plugin-rhel8 Red Hat OpenShift Service Mesh 2 openshift-service-mesh/kiali-ossmc-rhel8not affected: vulnerable code not present
+17 more productsfewer
Red Hat 3scale API Management Platform 2 3scale-amp2/system-rhel7 Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/console-rhel8 Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-roxctl-rhel8, advanced-cluster-security/rhacs-rhel8-operator, advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-scanner-v4-rhel8, advanced-cluster-security/rhacs-scanner-v4-db-rhel8 Red Hat Ansible Automation Platform 2 automation-gateway, automation-controller, automation-eda-controller Red Hat Developer Hub 1 rhdh/rhdh-hub-rhel9, rhdh-operator-container Red Hat Enterprise Linux 8 grafana, grafana-loki, grafana-mssql, grafana-mysql, grafana-selinux, grafana-graphite, +8 more Red Hat Enterprise Linux 9 grafana, grafana-selinux Red Hat Enterprise Linux 10 grafana Red Hat OpenShift AI (RHOAI) odh-operator-container, odh-dashboard-container Red Hat OpenShift Container Platform 4.12 openshift4 v4.12.0-202510280107.p2.g914cad8.assembly.stream.el8, openshift4 v4.12.0-202510280107.p2.g99077a3.assembly.stream.el8, openshift4 v4.12.0-202510281313.p2.g1a251f4.assembly.stream.el8, openshift4 v4.12.0-202510281313.p2.g32e6d25.assembly.stream.el8, openshift4 v4.12.0-202510281313.p2.g336d03e.assembly.stream.el8, openshift4 v4.12.0-202510281313.p2.g3b1f084.assembly.stream.el8, +173 more Red Hat OpenShift Container Platform 4.13 openshift4 v4.13.0-202511250107.p2.g01bbb23.assembly.stream.el8, openshift4 v4.13.0-202511250107.p2.g18c076b.assembly.stream.el8, openshift4 v4.13.0-202511250107.p2.g1a14e5c.assembly.stream.el8, openshift4 v4.13.0-202511250107.p2.g30fdccd.assembly.stream.el8, openshift4 v4.13.0-202511250107.p2.g312c5f2.assembly.stream.el8, openshift4 v4.13.0-202511250107.p2.g38f638f.assembly.stream.el8, +173 more Red Hat OpenShift Container Platform 4.14 rhcos 414.92.202411130444-0, openshift4 v4.14.0-202510211320.p2.g03e5f40.assembly.stream.el8, openshift4 v4.14.0-202510211320.p2.g08fb27e.assembly.stream.el8, openshift4 v4.14.0-202510211320.p2.g09d6209.assembly.stream.el8, openshift4 v4.14.0-202510211320.p2.g1713e97.assembly.stream.el8, openshift4 v4.14.0-202510211320.p2.g4e05963.assembly.stream.el8, +373 more Red Hat OpenShift Container Platform 4.15 openshift4 v4.15.0-202510211321.p2.g078c81f.assembly.stream.el9, openshift4 v4.15.0-202510211321.p2.g128d8e0.assembly.stream.el9, openshift4 v4.15.0-202510211321.p2.g1ae0ba7.assembly.stream.el9, openshift4 v4.15.0-202510211321.p2.g260a085.assembly.stream.el9, openshift4 v4.15.0-202510211321.p2.g37a0a91.assembly.stream.el9, openshift4 v4.15.0-202510211321.p2.g3d9f6f8.assembly.stream.el9, +180 more Red Hat OpenShift Container Platform 4.16 openshift4 v4.16.0-202510211319.p2.g04f80fa.assembly.stream.el9, openshift4 v4.16.0-202510211319.p2.g14571e8.assembly.stream.el9, openshift4 v4.16.0-202510211319.p2.g1e1194b.assembly.stream.el9, openshift4 v4.16.0-202510211319.p2.g29ba26d.assembly.stream.el9, openshift4 v4.16.0-202510211319.p2.g2ed3cf9.assembly.stream.el9, openshift4 v4.16.0-202510211319.p2.g3db7610.assembly.stream.el9, +182 more Red Hat OpenShift Container Platform 4.17 rhcos 417.94.202501220426-0, openshift4 v4.17.0-202510221139.p2.g08579e9.assembly.stream.el9, openshift4 v4.17.0-202510221139.p2.g19b025b.assembly.stream.el9, openshift4 v4.17.0-202510221139.p2.g2b2ba3b.assembly.stream.el9, openshift4 v4.17.0-202510221139.p2.g41b3424.assembly.stream.el9, openshift4 v4.17.0-202510221139.p2.g49a6faa.assembly.stream.el9, +279 more Red Hat OpenShift Container Platform 4.18 openshift4 v4.18.0-202510210939.p2.g01fc505.assembly.stream.el9, openshift4 v4.18.0-202510210939.p2.g0a6f6eb.assembly.stream.el9, openshift4 v4.18.0-202510210939.p2.g18c2332.assembly.stream.el9, openshift4 v4.18.0-202510210939.p2.g1c7bc07.assembly.stream.el9, openshift4 v4.18.0-202510210939.p2.g1f8672a.assembly.stream.el9, openshift4 v4.18.0-202510210939.p2.g2b24141.assembly.stream.el9, +180 more Red Hat OpenShift Container Platform 4.19 openshift4 v4.19.0-202510142112.p2.g034e486.assembly.stream.el9, openshift4 v4.19.0-202510142112.p2.g059d95c.assembly.stream.el9, openshift4 v4.19.0-202510142112.p2.g06a66db.assembly.stream.el9, openshift4 v4.19.0-202510142112.p2.g0ab3099.assembly.stream.el9, openshift4 v4.19.0-202510142112.p2.g1dbf0c7.assembly.stream.el9, openshift4 v4.19.0-202510142112.p2.g3dfcfa1.assembly.stream.el9, +180 more
10 more not affected in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
1.15% chance of exploitation in the next 30 days, higher than 67% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| GitHub | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | dompurify | <2.4.2 |
2.4.2 |
Affected products
- cure53 DOMPurify
Classification
- Weakness
-
- CWE-1321 Improperly Controlled Modification of Object Prototype Attributes
References
-
github.com
/cure53/DOMPurify/commit/d1dd0374caef2b4c56c3bd09fe1988c3479166dc
web, patch
-
github.com
/cure53/DOMPurify/security/advisories/GHSA-p3vf-v8qc-cwcr
web, vendor-advisory
-
lists.debian.org
/debian-lts-announce/2025/02/msg00010.html
web
-
nvd.nist.gov
/vuln/detail/CVE-2024-48910
advisory
-
github.com
/cure53/DOMPurify
package
Sources
- CVE List CVE-2024-48910
- GitHub Advisory GHSA-p3vf-v8qc-cwcr
- NVD CVE-2024-48910
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.