Loading vulnerability…
Nesting-based mutation XSS in DOMPurify
CVE-2024-47875 is a nesting-based mutation cross-site scripting (mXSS) vulnerability in DOMPurify, a DOM-based sanitizer for HTML, MathML, and SVG. Specially crafted nested markup can bypass sanitization when subsequent DOM parsing or mutation transforms the sanitized markup into executable content. Applications that render attacker-controlled markup sanitized by an affected DOMPurify version may execute attacker-controlled script in their security context. The vulnerability is fixed in DOMPurify 2.5.0 and 3.1.3.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise the confidentiality and integrity of an affected application's browser context through attacker-controlled script execution. Depending on the application's functionality and the victim's privileges, this may expose accessible application data, permit unauthorized actions under the victim's session, or alter displayed content. The vulnerability does not by itself establish server-side code execution; downstream impact depends on the integrating application.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is identified. For affected Siemens COMOS deployments, restrict network access with appropriate access controls and follow Siemens Industrial Security and COMOS security configuration guidance. These measures reduce exposure but do not correct the sanitizer bypass.
Patch, then assume compromise.
Upgrade DOMPurify to version 2.5.0 or later on the 2.x branch, or 3.1.3 or later on the 3.x branch. Update bundled copies through the relevant application's vendor-supported release. Identified downstream fixes include Siemens COMOS V10.4.5 for the V10.4 line and V10.5.2 for the V10.5 line, OX App Suite frontend 7.10.6-rev50, and OpenShift Container Platform 4.14.41, 4.15.38, 4.16.20, and 4.17.4 for their respective release lines. When backporting the DOMPurify fix, account for the related CVE-2024-45801 advisory rather than assuming an isolated cherry-pick is sufficient.
1 exploit validated by Mallory's analysis. Hidden: 1 rejected by Mallory's analysis as not a working exploit; 1 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.