CVE-2024-45801: cure53 dompurify

csirt@kutim:~/threat-intel/cve/CVE-2024-45801

CVSS 6.1 · Medium EPSS 0,89%

Kerentanan Inefficient Regular Expression Complexity pada cure53 dompurify. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also possible to use Prototype Pollution to weaken the depth check. This renders dompurify unable to avoid cross site scripting (XSS) attacks. This issue has been addressed in versions 2.5.4 and 3.1.3 of DOMPurify. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Rincian

Terbit di NVD: 16 September 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-1333: Inefficient Regular Expression Complexity
CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
EPSS (30 hari): 0,89% peluang dieksploitasi; lebih tinggi dari 58,4% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
cure53	dompurify	Semua versi sebelum 2.5.4
cure53	dompurify	Versi 3.0.0 hingga sebelum 3.1.3

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.