CVE-2019-16728 - DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demonstrated by Chrome and Safari

Back Back to CVE browser

MEDIUM

DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demonstrated by Chrome and Safari

Published Sep 24, 2019

6.1

MEDIUM

CVSS 3.1

EPSS 1.67%

Description

DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demonstrated by Chrome and Safari.

Affected products

Ecosystem	Package	Introduced	Fixed
npm	dompurify	0	2.0.3

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (5)

https://github.com/advisories/GHSA-chqj-j4fh-rw7m
Advisory
https://lists.debian.org/debian-lts-announce/2020/10/msg00029.html
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-16728
https://research.securitum.com/dompurify-bypass-using-mxss/
x_refsource_MISCExploitThird Party Advisory
https://www.npmjs.com/advisories/1205

Link	Providers	Tags
https://github.com/advisories/GHSA-chqj-j4fh-rw7m		Advisory
https://lists.debian.org/debian-lts-announce/2020/10/msg00029.html		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-16728
https://research.securitum.com/dompurify-bypass-using-mxss/		x_refsource_MISCExploitThird Party Advisory
https://www.npmjs.com/advisories/1205