CVE-2024-47875

What it actually does

Bypasses DOMPurify sanitization via nested HTML/MathML/SVG structures, allowing mXSS payload execution after processing.

Why it matters to the business

Applications relying on this sanitizer for user-generated content face risk of script injection that could lead to session hijacking or data exposure, though low exploit likelihood reduces immediate operational urgency.

How an attack unfolds

An attacker supplies crafted nested content that evades the sanitizer's nesting checks; after sanitization the payload executes as script in the browser context of users viewing the processed output.

How to fix it

Upgrade cure53/dompurify to version 2.5.0, 3.1.3, or apply commit 3fe78d7501103832166613bb1452985dd4674008 in all affected packages and rebuild dependent applications.

How to confirm the fix worked

Verify installed package versions against fixed releases, re-run sanitization unit tests with known nesting mXSS vectors, and confirm no bypass occurs on updated instances.

Typical attack path

1. Locate web applications or libraries depending on vulnerable DOMPurify versions
2. Craft a nesting-based mXSS payload targeting the sanitizer's weaknesses
3. Deliver the payload through user-controlled input fields sanitized by the library
4. Trigger rendering in a victim's browser to achieve script execution

How to detect it

Review application logs for unexpected script tags or execution events following sanitization calls; examine client-side rendered output for anomalies introduced by user input.

What your security team should do

• Prioritize upgrade of DOMPurify across all codebases due to direct XSS exposure
• Audit all sanitization call sites to ensure only fixed versions are in use
• Add dependency scanning to CI pipelines to prevent reintroduction of vulnerable releases