CVE-2019-25155 - DOMPurify before 1.0.11 allows reverse tabnabbing in demos/hooks-target-blank-demo.html because links lack a 'rel="noopener noreferrer"' attribute

MEDIUM

DOMPurify before 1.0.11 allows reverse tabnabbing in demos/hooks-target-blank-demo.html because links lack a 'rel="noopener noreferrer"' attribute

Published Oct 31, 2023

6.1

MEDIUM

CVSS 3.1

EPSS 0.51%

DOMPurify before 1.0.11 allows reverse tabnabbing in demos/hooks-target-blank-demo.html because links lack a 'rel="noopener noreferrer"' attribute.

Ecosystem	Package	Introduced	Fixed
npm	dompurify	0	1.0.11

No remediation recorded yet.

Weaknesses (1)

CWE-601

Open Redirect

Link	Providers	Tags
https://github.com/advisories/GHSA-8hgg-xxm5-3873		Advisory
https://github.com/cure53/DOMPurify/commit/7601c33a57e029cce51d910eda5179a3f1b51c83
https://github.com/cure53/DOMPurify/compare/1.0.10...1.0.11		Patch
https://github.com/cure53/DOMPurify/pull/337
https://github.com/cure53/DOMPurify/pull/337/files		Patch
https://nvd.nist.gov/vuln/detail/CVE-2019-25155