CVE-2024-21541: Matthewmueller Dom-Iterator

Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days.

Versions of the package dom-iterator before 1.0.1 are vulnerable to Arbitrary Code Execution due to use of the Function constructor without complete input sanitization. Function generates a new function body and thus care must be given to ensure that the inputs to Function are not attacker-controlled. The risks involved are similar to that of allowing attacker-controlled input to reach eval.

Affected products

• Matthewmueller Dom-Iterator: up to and including 1.0.0

Published 2024-11-13. Last modified 2026-06-17.