CVE-2024-48910: CURE53 Dompurify

Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days.

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability is fixed in 2.4.2.

Affected products

• CURE53 Dompurify: before 2.4.2 (fixed in 2.4.2)

Published 2024-10-31. Last modified 2026-06-17.