DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects w…
中危 CVSS 6.1
摘要
DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements, causing scripts to execute when the sanitized tree is inserted into a live document.
中文摘要建设中，暂以英文摘要呈现（DR-003 v2）。
深度研判 · 自动通道
该漏洞尚未生成深度研判报告（DR-003 v2 AI pipeline 建设中）。
受影响产品
- :
数据来源
- NVD DATABASE
原始链接
- https://github.com/cure53/DOMPurify/security/advisories/GHSA-x4vx-rjvf-j5p4 Exploit
- https://www.vulncheck.com/advisories/dompurify-cross-site-scripting-via-in-place-nodename Third Party Advisory
- https://github.com/cure53/DOMPurify/security/advisories/GHSA-x4vx-rjvf-j5p4 Exploit
时间线
- nvd_ingest NVD