CVE-2024-48910

DOMPurify vulnerable to tampering by prototype polution

9.1 CriticalPublic exploitFix available

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability is fixed in 2.4.2.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: None

Exploit likelihood

1.15%Up 1.1 points since Nov 1, 2024

What each source reports

CVE List Score used 9.1

DOMPurify vulnerable to tampering by prototype polution

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability is fixed in 2.4.2.

Record: CVE-2024-48910
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-1321
Updated: 2026-11-02

EUVDEUVD-2024-3092 9.1

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability is fixed in 2.4.2.

Record: EUVD-2024-3092
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-p3vf-v8qc-cwcr 9.3

DOMPurify vulnerable to tampering by prototype polution

dompurify was vulnerable to prototype pollution

Fixed by https://github.com/cure53/DOMPurify/commit/d1dd0374caef2b4c56c3bd09fe1988c3479166dc

Record: GHSA-p3vf-v8qc-cwcr
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-1321
Updated: 2026-11-02

NVD 9.1

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability is fixed in 2.4.2.

Record: CVE-2024-48910
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-1321
Updated: 2026-11-02

OSV 9.1

DOMPurify vulnerable to tampering by prototype polution

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability is fixed in 2.4.2.

Record: CVE-2024-48910
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-1321
Updated: 2026-11-02

OSVDEBIAN-CVE-2024-48910 9.8

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability is fixed in 2.4.2.

Record: DEBIAN-CVE-2024-48910
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 8 moreShow less

OSVGHSA-p3vf-v8qc-cwcr 9.3

DOMPurify vulnerable to tampering by prototype polution

dompurify was vulnerable to prototype pollution

Fixed by https://github.com/cure53/DOMPurify/commit/d1dd0374caef2b4c56c3bd09fe1988c3479166dc

Record: GHSA-p3vf-v8qc-cwcr
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-1321
Updated: 2026-11-02

OSVUBUNTU-CVE-2024-48910 9.1

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability is fixed in 2.4.2.

Record: UBUNTU-CVE-2024-48910
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVCLSA-2026-1774398077 No score

TuxCare security update for dompurify (4 CVEs)

TuxCare rebuilt dompurify to address 4 CVEs. Fixed in 2.3.0-tuxcare.1.

Record: CLSA-2026-1774398077
Updated: 2026-11-02

OSVCLSA-2026-1780274972 No score

TuxCare security update for dompurify (9 CVEs)

TuxCare rebuilt dompurify to address 9 CVEs. Fixed in 2.4.0-tuxcare.1.

Record: CLSA-2026-1780274972
Updated: 2026-11-02

OSVCLSA-2026-1786539981 No score

TuxCare security update for dompurify (10 CVEs)

TuxCare rebuilt dompurify to address 10 CVEs. Fixed in 2.3.0-tuxcare.1.

Record: CLSA-2026-1786539981
Updated: 2026-11-02

OSVCLSA-2026-1786636600 No score

TuxCare security update for dompurify (16 CVEs)

TuxCare rebuilt dompurify to address 16 CVEs. Fixed in 2.4.0-tuxcare.1.

Record: CLSA-2026-1786636600
Updated: 2026-11-02

OSVCLSA-2026-1792155956 No score

TuxCare security update for dompurify (5 CVEs)

TuxCare rebuilt dompurify to address 5 CVEs. Fixed in 2.3.3-tuxcare.2.

Record: CLSA-2026-1792155956
Updated: 2026-11-02

OSVCLSA-2026-1792156803 No score

TuxCare security update for dompurify (5 CVEs)

TuxCare rebuilt dompurify to address 5 CVEs. Fixed in 2.3.10-tuxcare.2.

Record: CLSA-2026-1792156803
Updated: 2026-11-02

Affected products

cure53 dompurify

Affected packages

Affected packages
Package	Affected	Fixed
`dompurify` npm	before 2.4.2	2.4.2
`dompurify` TuxCare:npm From an advisory covering 4 CVEs	2.3.0-tuxcare.0 up to 2.3.0-tuxcare.1, plus listed versions 2.3.0	2.3.0-tuxcare.1
`dompurify` TuxCare:npm From an advisory covering 5 CVEs	2.4.0-tuxcare.0 up to 2.4.0-tuxcare.1, plus listed versions 2.4.0	2.4.0-tuxcare.1
`dompurify` TuxCare:npm From an advisory covering 5 CVEs	2.3.3-tuxcare.0 up to 2.3.3-tuxcare.2, plus listed versions 2.3.32.3.3-tuxcare.1	2.3.3-tuxcare.2
`dompurify` TuxCare:npm From an advisory covering 5 CVEs	2.3.10-tuxcare.0 up to 2.3.10-tuxcare.2, plus listed versions 2.3.102.3.10-tuxcare.1	2.3.10-tuxcare.2
`cacti` Debian:12	before 1.2.24+ds1-1+deb12u2, plus listed versions 1.2.24+ds1-11.2.24+ds1-1+deb12u1	1.2.24+ds1-1+deb12u2
`cacti` Debian:13	before 1.2.26+ds1-1	1.2.26+ds1-1
`cacti` Debian:14	before 1.2.26+ds1-1	1.2.26+ds1-1
`node-dompurify` Debian:12	before 2.4.1+dfsg+~2.4.0-2+deb12u1, plus listed versions 2.4.1+dfsg+~2.4.0-12.4.1+dfsg+~2.4.0-2	2.4.1+dfsg+~2.4.0-2+deb12u1
`node-dompurify` Debian:13	before 3.0.9+dfsg+~3.0.5-1	3.0.9+dfsg+~3.0.5-1
`node-dompurify` Debian:14	before 3.0.9+dfsg+~3.0.5-1	3.0.9+dfsg+~3.0.5-1
`cacti` Debian:11 From an advisory covering 11 CVEs	before 1.2.16+ds1-2+deb11u5, plus listed versions 1.2.16+ds1-21.2.16+ds1-2+deb11u11.2.16+ds1-2+deb11u21.2.16+ds1-2+deb11u31.2.16+ds1-2+deb11u4	1.2.16+ds1-2+deb11u5
`node-dompurify` Ubuntu:22.04:LTS	All versions, plus listed versions 2.3.0+dfsg-22.3.3+dfsg-1	None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	Mitchellzhou1/CVE-2024-48910-PoC	2025-11-11
PoC in GitHub	Alex-Acero-Security/CVE-2024-48910-POC	2025-11-12

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected
Nov 5, 2026	exploits, facts
Nov 3, 2026	affected
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-48910 is a critical vulnerability (CVSS 9.1) in Cure53 Dompurify, published October 31, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.15%, the 67th percentile. Fixed in dompurify 2.4.2.

References

Show 4 moreShow less