Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-vbs9-gben-9kgc
Vulnerability ID VCID-vbs9-gben-9kgc
Aliases CVE-2024-48910
GHSA-p3vf-v8qc-cwcr
Summary DOMPurify vulnerable to tampering by prototype polution dompurify was vulnerable to prototype pollution Fixed by https://github.com/cure53/DOMPurify/commit/d1dd0374caef2b4c56c3bd09fe1988c3479166dc
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 8.2 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-48910.json
epss 0.02592 https://api.first.org/data/v1/epss?cve=CVE-2024-48910
epss 0.02592 https://api.first.org/data/v1/epss?cve=CVE-2024-48910
epss 0.02592 https://api.first.org/data/v1/epss?cve=CVE-2024-48910
epss 0.02592 https://api.first.org/data/v1/epss?cve=CVE-2024-48910
epss 0.02592 https://api.first.org/data/v1/epss?cve=CVE-2024-48910
epss 0.02592 https://api.first.org/data/v1/epss?cve=CVE-2024-48910
epss 0.02592 https://api.first.org/data/v1/epss?cve=CVE-2024-48910
epss 0.02808 https://api.first.org/data/v1/epss?cve=CVE-2024-48910
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-p3vf-v8qc-cwcr
cvssv3.1 9.1 https://github.com/cure53/DOMPurify
cvssv4 9.3 https://github.com/cure53/DOMPurify
generic_textual CRITICAL https://github.com/cure53/DOMPurify
cvssv3.1 9.1 https://github.com/cure53/DOMPurify/commit/d1dd0374caef2b4c56c3bd09fe1988c3479166dc
cvssv4 9.3 https://github.com/cure53/DOMPurify/commit/d1dd0374caef2b4c56c3bd09fe1988c3479166dc
generic_textual CRITICAL https://github.com/cure53/DOMPurify/commit/d1dd0374caef2b4c56c3bd09fe1988c3479166dc
ssvc Track https://github.com/cure53/DOMPurify/commit/d1dd0374caef2b4c56c3bd09fe1988c3479166dc
cvssv3.1 9.1 https://github.com/cure53/DOMPurify/security/advisories/GHSA-p3vf-v8qc-cwcr
cvssv3.1_qr CRITICAL https://github.com/cure53/DOMPurify/security/advisories/GHSA-p3vf-v8qc-cwcr
cvssv4 9.3 https://github.com/cure53/DOMPurify/security/advisories/GHSA-p3vf-v8qc-cwcr
generic_textual CRITICAL https://github.com/cure53/DOMPurify/security/advisories/GHSA-p3vf-v8qc-cwcr
ssvc Track https://github.com/cure53/DOMPurify/security/advisories/GHSA-p3vf-v8qc-cwcr
cvssv3.1 9.1 https://lists.debian.org/debian-lts-announce/2025/02/msg00010.html
cvssv4 9.3 https://lists.debian.org/debian-lts-announce/2025/02/msg00010.html
generic_textual CRITICAL https://lists.debian.org/debian-lts-announce/2025/02/msg00010.html
cvssv3.1 9.1 https://nvd.nist.gov/vuln/detail/CVE-2024-48910
cvssv4 9.3 https://nvd.nist.gov/vuln/detail/CVE-2024-48910
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2024-48910
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-48910.json
https://api.first.org/data/v1/epss?cve=CVE-2024-48910
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-48910
https://github.com/cure53/DOMPurify
https://github.com/cure53/DOMPurify/commit/d1dd0374caef2b4c56c3bd09fe1988c3479166dc
https://github.com/cure53/DOMPurify/security/advisories/GHSA-p3vf-v8qc-cwcr
https://lists.debian.org/debian-lts-announce/2025/02/msg00010.html
https://nvd.nist.gov/vuln/detail/CVE-2024-48910
2322949 https://bugzilla.redhat.com/show_bug.cgi?id=2322949
GHSA-p3vf-v8qc-cwcr https://github.com/advisories/GHSA-p3vf-v8qc-cwcr
RHSA-2024:10186 https://access.redhat.com/errata/RHSA-2024:10186
RHSA-2024:9583 https://access.redhat.com/errata/RHSA-2024:9583
RHSA-2025:0079 https://access.redhat.com/errata/RHSA-2025:0079
RHSA-2025:0082 https://access.redhat.com/errata/RHSA-2025:0082
RHSA-2025:0654 https://access.redhat.com/errata/RHSA-2025:0654
RHSA-2025:0875 https://access.redhat.com/errata/RHSA-2025:0875
RHSA-2025:18233 https://access.redhat.com/errata/RHSA-2025:18233
RHSA-2025:19003 https://access.redhat.com/errata/RHSA-2025:19003
RHSA-2025:19017 https://access.redhat.com/errata/RHSA-2025:19017
RHSA-2025:19047 https://access.redhat.com/errata/RHSA-2025:19047
RHSA-2025:19306 https://access.redhat.com/errata/RHSA-2025:19306
RHSA-2025:19314 https://access.redhat.com/errata/RHSA-2025:19314
RHSA-2025:19895 https://access.redhat.com/errata/RHSA-2025:19895
RHSA-2025:22284 https://access.redhat.com/errata/RHSA-2025:22284
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-48910.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/cure53/DOMPurify
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N Found at https://github.com/cure53/DOMPurify
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/cure53/DOMPurify/commit/d1dd0374caef2b4c56c3bd09fe1988c3479166dc
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N Found at https://github.com/cure53/DOMPurify/commit/d1dd0374caef2b4c56c3bd09fe1988c3479166dc
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-10-31T15:52:58Z/ Found at https://github.com/cure53/DOMPurify/commit/d1dd0374caef2b4c56c3bd09fe1988c3479166dc
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/cure53/DOMPurify/security/advisories/GHSA-p3vf-v8qc-cwcr
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N Found at https://github.com/cure53/DOMPurify/security/advisories/GHSA-p3vf-v8qc-cwcr
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-10-31T15:52:58Z/ Found at https://github.com/cure53/DOMPurify/security/advisories/GHSA-p3vf-v8qc-cwcr
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://lists.debian.org/debian-lts-announce/2025/02/msg00010.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N Found at https://lists.debian.org/debian-lts-announce/2025/02/msg00010.html
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-48910
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-48910
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.85547
EPSS Score 0.02592
Published At April 4, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:49:10.090016+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/10/GHSA-p3vf-v8qc-cwcr/GHSA-p3vf-v8qc-cwcr.json 38.0.0