{"id":"CVE-2024-47875","published":"2024-10-11T14:59:27Z","modified":"2025-11-03T20:40:56Z","title":"DOMPurify nesting-based mXSS","vendor":"cure53","product":"DOMPurify","tier":"tail","description":{"text":"DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3.","provenance":"source","from":"CVE.org"},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01134,"percentile":0.66489,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-gx9m-whjm-85jf","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/cure53/DOMPurify/commit/0ef5e537a514f904b6aa1d7ad9e749e365d7185f","tags":["x_refsource_MISC"]},{"url":"https://github.com/cure53/DOMPurify/commit/6ea80cd8b47640c20f2f230c7920b1f4ce4fdf7a","tags":["x_refsource_MISC"]},{"url":"https://github.com/cure53/DOMPurify/blob/0ef5e537a514f904b6aa1d7ad9e749e365d7185f/test/test-suite.js#L2098","tags":["x_refsource_MISC"]},{"url":"http://seclists.org/fulldisclosure/2025/Apr/14","tags":[]},{"url":"https://lists.debian.org/debian-lts-announce/2025/02/msg00010.html","tags":[]}],"priority":{"score":25.3,"factors":[{"name":"EPSS percentile","points":13.3},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":7.0}]},"exploitSources":{"pocGithub":{"count":1,"skipped":1,"earliest":"2025-09-02","earliestUrl":"https://github.com/roj1py/CVE-2024-47875-PhpSpreadsheet-XSS-PoC","repos":[{"name":"roj1py/CVE-2024-47875-PhpSpreadsheet-XSS-PoC","url":"https://github.com/roj1py/CVE-2024-47875-PhpSpreadsheet-XSS-PoC","stars":1,"created":"2025-09-02"}]},"first":{"date":"2025-09-02","source":"PoC-in-GitHub","url":"https://github.com/roj1py/CVE-2024-47875-PhpSpreadsheet-XSS-PoC"},"provenance":"source"},"vendorSlug":"cure53","affectedVersions":[{"vendor":"cure53","product":"DOMPurify","versions":["< 2.5.0","< 3.1.3"]}],"affected":[{"ecosystem":"npm","package":"dompurify","vulnerableRanges":["<2.5.0",">=3.0.0, <3.1.3"],"patched":["2.5.0","3.1.3"],"from":["GHSA-gx9m-whjm-85jf"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-3049","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2020-26870","published":"2020-10-07","fixed":"2.0.17","kev":false},{"cve":"CVE-2024-48910","published":"2024-10-31","fixed":"2.4.2","kev":false},{"cve":"CVE-2024-45801","published":"2024-09-16","fixed":"3.1.3","kev":false},{"cve":"CVE-2024-47875","published":"2024-10-11","fixed":"3.1.3","kev":false},{"cve":"CVE-2025-26791","published":"2025-02-14","fixed":"3.2.4","kev":false,"link":{"from":"CVE-2024-47875","to":"CVE-2025-26791","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:dompurify","fromFixed":"3.1.3","toFixed":"3.2.4","daysApart":126}]}},{"cve":"CVE-2025-15599","published":"2026-03-03","fixed":"3.2.7","kev":false},{"cve":"CVE-2026-0540","published":"2026-03-03","fixed":"3.3.2","kev":false}],"package":"npm:dompurify"}}