CVE-2024-47875

Publication date 11 October 2024

Last updated 11 July 2025

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

10.0 · Critical

Score breakdown

Description

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3.

Status

Package Ubuntu Release Status
node-dompurify 26.04 LTS resolute
Needs evaluation
25.10 questing Ignored end of life, was needs-triage
25.04 plucky Ignored end of life, was needs-triage
24.10 oracular Ignored end of life, was needs-triage
24.04 LTS noble
Needs evaluation
22.04 LTS jammy
Needs evaluation
20.04 LTS focal Not in release

Severity score breakdown

CVSS version: CVSS v3.0

Base score 10.0 · Critical

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H

References

Other references

Access our resources on patching vulnerabilities