CVE-2023-49146: XSS
Published Nov 22, 2023
·Updated
DOMSanitizer (aka dom-sanitizer) before 1.0.7 allows XSS via an SVG document because of mishandling of comments and greedy regular expressions.
Affected Software
2 affected componentsFixes available
composer/rhukster/dom-sanitizer<1.0.7
1.0.7
getgrav Dom-sanitizer<1.0.7
Remediation
Event History
Nov 22, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Nov 23, 2023
Advisory Published
12:30 AM
Frequently Asked Questions
1
What is the vulnerability ID for DOMSanitizer?
The vulnerability ID for DOMSanitizer is CVE-2023-49146.
2
How does DOMSanitizer allow XSS attacks?
DOMSanitizer allows XSS attacks by mishandling comments and greedy regular expressions in SVG documents.
3
What is the affected version of DOMSanitizer?
The affected version of DOMSanitizer is before 1.0.7.
4
How can I fix the DOMSanitizer vulnerability?
To fix the DOMSanitizer vulnerability, update to version 1.0.7 or later.
5
What is the Common Weakness Enumeration (CWE) ID for DOMSanitizer?
The CWE ID for DOMSanitizer is CWE-79.