{"id":"CVE-2020-26870","published":"2020-10-07T15:50:09Z","modified":"2024-08-04T16:03:22Z","title":"Cure53 DOMPurify before 2.0.17 allows mutation XSS","vendor":null,"product":null,"tier":"tail","description":{"text":"Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as demonstrated by nesting of FORM elements.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.04881,"percentile":0.92065,"provenance":"source"},"cwes":[],"references":[{"url":"https://research.securitum.com/mutation-xss-via-mathml-mutation-dompurify-2-0-17-bypass/","tags":["x_refsource_MISC"]},{"url":"https://github.com/cure53/DOMPurify/commit/02724b8eb048dd219d6725b05c3000936f11d62d","tags":["x_refsource_MISC"]},{"url":"https://github.com/cure53/DOMPurify/compare/2.0.16...2.0.17","tags":["x_refsource_MISC"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/10/msg00029.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-26870","tags":["vendor-advisory","x_refsource_MS"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_refsource_MISC"]}],"priority":{"score":18.4,"factors":[{"name":"EPSS percentile","points":18.41}]},"affected":[{"ecosystem":"npm","package":"dompurify","vulnerableRanges":["<2.0.17"],"patched":["2.0.17"],"from":["GHSA-63q7-h895-m982"],"provenance":"source"}],"euvd":{"id":"EUVD-2020-1486","exploited":false,"provenance":"source"},"lineage":{"children":[{"from":"CVE-2020-26870","to":"CVE-2021-38193","relation":"related","confidence":"low","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"related","quote":"XSS can occur because the parsing differences for HTML, SVG, and MathML are mishandled, a similar issue to CVE-2020-26870.","from":"CVE.org","in":"CVE-2021-38193"}]}],"packageHistory":[{"cve":"CVE-2019-25155","published":"2023-10-31","fixed":"1.0.11","kev":false},{"cve":"CVE-2019-16728","published":"2019-09-24","fixed":"2.0.3","kev":false,"link":{"from":"CVE-2019-16728","to":"CVE-2020-26870","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:dompurify","fromFixed":"2.0.3","toFixed":"2.0.17","daysApart":379}]}},{"cve":"CVE-2020-26870","published":"2020-10-07","fixed":"2.0.17","kev":false},{"cve":"CVE-2024-48910","published":"2024-10-31","fixed":"2.4.2","kev":false},{"cve":"CVE-2024-45801","published":"2024-09-16","fixed":"3.1.3","kev":false},{"cve":"CVE-2024-47875","published":"2024-10-11","fixed":"3.1.3","kev":false}],"package":"npm:dompurify"}}