Loading vulnerability…
CVE-2024-48910 is a prototype-pollution vulnerability in DOMPurify, a DOM-based sanitizer for HTML, MathML, and SVG. A remote attacker can add or modify attributes on JavaScript object prototypes, tampering with DOMPurify or affecting other components that consume inherited properties. Polluted attributes may alter application behavior, inject malicious attributes into downstream components, bypass security controls, or replace expected values with incompatible types.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (4 hidden).
This repository is a Proof of Concept (PoC) for CVE-2024-48910, a prototype pollution vulnerability in DOMPurify 2.4.1. The repository contains a Node.js Express server (server.js) that exposes several endpoints: /api/config (for receiving attacker-controlled JSON), /api/comments (for a live comment section), and /config.js (for serving dynamic JavaScript reflecting the polluted prototype). The public/index.html file provides a web interface to demonstrate the attack, including a step-by-step guide for polluting the prototype and exploiting the vulnerability to achieve XSS via the comment section. The exploit works by sending a specially crafted JSON payload to /api/config, which merges the payload into a server-side object without protection against __proto__, resulting in prototype pollution. This pollution is then reflected in the browser, where DOMPurify's sanitization can be bypassed, allowing for XSS. The repository is structured as a minimal demo with clear separation between server logic, static assets, and the exploit demonstration interface.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A DOMPurify prototype-pollution gadget vulnerability cited as a comparison; exploitation requires pre-existing prototype pollution in the application context.
A prototype-pollution issue that can enable tampering with DOMPurify.
Prototype-pollution vulnerability that enables tampering with DOMPurify.
A DOMPurify prototype-pollution issue that permits tampering.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.