node-dompurify vulnerabilities (Ubuntu)
32 vulnerabilities.
-
node-dompurifyUbuntu DOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached Subtrees 5.1 Medium -
node-dompurifyUbuntu DOMPurify from 3.4.4 before 3.4.17 SAFE_FOR_TEMPLATES Bypass via Shadow Root Content 5.1 Medium -
node-dompurifyUbuntu DOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Mode 5.1 Medium -
node-dompurifyUbuntu DOMPurify before 3.4.16 XSS via IN_PLACE Returned Rawtext Root 5.1 Medium -
node-dompurifyUbuntu DOMPurify from 3.4.13 before 3.4.16 DOM XSS via IN_PLACE afterSanitize Hooks 5.1 Medium -
node-dompurifyUbuntu DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook 5.1 Medium -
node-dompurifyUbuntu DOMPurify before 3.4.0 XSS via ADD_ATTR/ADD_TAGS State Leakage 5.1 Medium -
node-dompurifyUbuntu DOMPurify through 3.3.3 Cross-Site Scripting via IN_PLACE mode 2.3 Low -
node-dompurifyUbuntu DOMPurify 3.4.6 Cross-Site Scripting via IN_PLACE nodeName 5.1 Medium -
node-dompurifyUbuntu DOMPurify before 3.4.8 Template Expression Injection via RETURN_DOM 5.1 Medium -
node-dompurifyUbuntu DOMPurify XSS via `selectedcontent` re-clone 8.2 High -
node-dompurifyUbuntu DOMPurify XSS via Missing Rawtext Elements in SAFE_FOR_XML 5.3 Medium -
node-dompurifyUbuntu In DOMPurify through 3.2.5 before 6bc6d60, scripts/server.js does not ensure that a pathname is... 7.5 High -
node-dompurifyUbuntu DOMPurify vulnerable to tampering by prototype polution 9.1 Critical -
node-dompurifyUbuntu DOMPurify before 3.4.12 Hook Bypass via CUSTOM_ELEMENT_HANDLING 5.1 Medium -
node-dompurifyUbuntu DOMPurify before 3.3.2 Mutation XSS via Re-Contextualization 5.3 Medium -
node-dompurifyUbuntu DOMPurify before 3.3.2 Prototype Pollution via USE_PROFILES 5.1 Medium -
node-dompurifyUbuntu DOMPurify before 3.3.2 URI Validation Bypass via ADD_ATTR 5.1 Medium -
node-dompurifyUbuntu DOMPurify before 3.4.0 ADD_TAGS Function Bypasses FORBID_TAGS 5.1 Medium -
node-dompurifyUbuntu DOMPurify before 3.4.7 Hook Mutation Pollution via allowedTags 5.3 Medium -
node-dompurifyUbuntu DOMPurify before 3.4.9 Trusted Types Policy State Contamination 5.1 Medium -
node-dompurifyUbuntu DOMPurify before 3.4.11 Permanent Attribute Allowlist Pollution via setConfig 5.1 Medium -
node-dompurifyUbuntu DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content 6.3 Medium -
node-dompurifyUbuntu DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM 6.1 Medium -
node-dompurifyUbuntu DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks 6.1 Medium -
node-dompurifyUbuntu DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix) 6.0 Medium -
node-dompurifyUbuntu DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode 6.8 Medium -
node-dompurifyUbuntu DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback 6.9 Medium -
node-dompurifyUbuntu Arbitrary Code Execution in handlebars 4.5 Medium -
node-dompurifyUbuntu DOMPurify XSS via Textarea Rawtext Bypass in SAFE_FOR_XML 5.1 Medium -
node-dompurifyUbuntu DOMPurify nesting-based mXSS 10.0 Critical -
node-dompurifyUbuntu Tampering by prototype polution in DOMPurify 7.3 High