CVE Vulnerability Catalog

DOMPurify before version 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as allowed attributes, leading to DOM-based XSS.

DOMPurify before version 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck. Attackers can supply a predicate that accepts specific attribute and tag combinations to bypass URI-safe validation, allowing unsafe protocols like javascript: to survive sanitization, leading to DOM-based XSS when the link is activated.

In DOMPurify through version 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) across subsequent sanitize() calls on the same instance. If a later call provides ADD_ATTR or ADD_TAGS as an array rather than a function, the previously set function handler is neither cleared nor overwritten, so it continues to approve attacker-controlled attributes or tags. This can allow dangerous event-handler attributes or forbidden tags (bypassing FORBID_TAGS) to survive sanitization, resulting in cross-site scripting.

DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument). A cross-realm instanceof check in the private _isNode() function returns false for foreign-realm nodes, causing DOMPurify to stringify the element (yielding '[object HTMLDivElement]'), silently reset IN_PLACE to false, and return the unsanitized element unchanged with any XSS payloads intact.

DOMPurify before version 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions. Attackers can craft input containing tags listed in FORBID_TAGS that are also added via ADD_TAGS function, causing them to be retained in sanitized output.

DOMPurify before 3.4.7 passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks when sanitize is called without an explicit cfg. A hook that mutates these fields permanently widens the default allow-lists for the lifetime of the DOMPurify instance, so subsequent default-config sanitize calls inherit the widened defaults.

DOMPurify through version 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements, causing scripts to execute when the sanitized tree is inserted into a live document.

DOMPurify versions 3.0.0 to before 3.4.8, when configured with SAFE_FOR_TEMPLATES and a DOM output mode, fail to strip template expressions inside <template> elements. The final scrub pass does not process template.content, so expressions may survive and be evaluated by a downstream template engine.

DOMPurify 3.0.0 before version 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied TRUSTED_TYPES_POLICY. A later caller that requests RETURN_TRUSTED_TYPE output receives a TrustedHTML object created by the old (potentially unsafe) policy rather than a clean default, which can lead to script execution at a Trusted Types sink. Passing TRUSTED_TYPES_POLICY: null on the later call also does not clear the retained policy.

A security vulnerability has been detected in release-it conventional-changelog up to version 11.0.1. It affects the function writeChangelog in the file index.js of the Changelog File Handler component. Manipulation of the argument infile leads to OS command injection. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

A weakness has been identified in bahmutov find-cypress-specs up to version 1.54.12. The impacted element is the function shell.exec in the file src/index.js of the Branch Handler component. Manipulation of the argument --branch causes OS command injection. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

SiYuan before version 3.7.2 contains a path traversal vulnerability in the /export/temp/ branch of the serveExport handler. An authenticated attacker can use percent-encoded traversal sequences to read arbitrary files outside TempDir, including /etc/passwd, SSH keys, and database files.

The Shop Manager plugin for WordPress up to version 2.5 contains a Cross Site Scripting (XSS) vulnerability in the Tabs functionality.

The Machete plugin for WordPress up to version 5.2 contains a Cross Site Scripting (XSS) vulnerability exploitable by users with Author privileges.

The Cyr to Lat reloaded – transliteration of links and file names plugin for WordPress up to version 1.3.3 contains a Broken Access Control vulnerability exploitable by Subscribers.

The افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) plugin for WordPress up to version 4.4.5 contains an Unauthenticated Cross Site Request Forgery (CSRF) vulnerability.

The TinyMCE Templates plugin for WordPress up to version 4.8.1 contains a Sensitive Data Exposure vulnerability exploitable by Contributors.

The Custom links in Elementor Image Carousel plugin for WordPress up to version 1.1.1 contains a Cross Site Scripting (XSS) vulnerability exploitable by Authors.

The Smart SEO Tool plugin for WordPress up to version 4.1.2 contains a Cross Site Scripting (XSS) vulnerability exploitable by Contributors.

The Qubely plugin for WordPress up to version 1.8.14 contains an Unauthenticated Broken Access Control vulnerability.