CVE-2024-48910 in DOMPurify
Summary
by MITRE • 10/31/2024
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability is fixed in 2.4.2.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 03/16/2026
DOMPurify serves as a critical security component in web applications by sanitizing HTML content to prevent cross-site scripting attacks through the removal of potentially malicious elements. The vulnerability identified as CVE-2024-48910 represents a prototype pollution flaw that undermines the integrity of this security mechanism. Prototype pollution occurs when an attacker can manipulate the prototype of built-in JavaScript objects, leading to unexpected behavior in applications that rely on these objects. This specific vulnerability allows malicious actors to inject malicious code through carefully crafted input that exploits the way DOMPurify handles object prototypes during the sanitization process.
The technical nature of this prototype pollution vulnerability stems from improper handling of object properties during the sanitization routine. When DOMPurify processes HTML content, it creates or modifies object structures that may inadvertently affect the prototype chain of JavaScript objects. This flaw enables attackers to inject properties into the Object.prototype or other built-in object prototypes, which can then be exploited by subsequent code that iterates over object properties or relies on prototype-based inheritance patterns. The vulnerability is particularly concerning because it occurs within a security library that is designed to prevent exactly this type of attack, creating a paradox where the tool meant to protect against XSS becomes a potential vector for more sophisticated attacks.
The operational impact of this vulnerability extends beyond traditional XSS exploitation as it can lead to more severe consequences including privilege escalation, denial of service, or even remote code execution in certain environments. When prototype pollution occurs within a sanitization library, it can affect not only the immediate application but potentially compromise the entire JavaScript runtime environment. Attackers can leverage this vulnerability to manipulate the behavior of other parts of the application that depend on prototype-based functionality, creating cascading effects that may go undetected for extended periods. The vulnerability also represents a significant concern for organizations that rely heavily on DOMPurify for content sanitization across multiple applications and services.
Security practitioners should immediately upgrade to DOMPurify version 2.4.2 to address this vulnerability, as earlier versions remain susceptible to prototype pollution attacks. The fix implemented in version 2.4.2 addresses the root cause by properly validating and sanitizing object properties during the processing pipeline to prevent unauthorized modifications to prototype objects. Organizations should also conduct thorough security assessments of their applications to identify any potential exploitation attempts and monitor for unusual behavior patterns that might indicate prototype pollution activity. This vulnerability aligns with CWE-471, which describes the weakness of "Modification of Assumed-Immutable Data" and relates to ATT&CK technique T1068, "Exploitation for Privilege Escalation," as the prototype pollution can be leveraged to gain elevated privileges within the application environment.