Description

DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demonstrated by Chrome and Safari.

Remediation

References

CVE-2019-16728

Related Vulnerabilities

Perl Numeric Errors Vulnerability (CVE-2010-1158)

WordPress Plugin Print-O-Matic Cross-Site Scripting (2.0.2)

WordPress Plugin Forums 'url' Parameter Arbitrary File Disclosure (1.4.3)

WordPress Plugin Video Player Unspecified Vulnerability (1.1.4)

Jenkins Improper Link Resolution Before File Access ('Link Following') Vulnerability (CVE-2021-21686)

Severity

Medium

Classification

CVE-2019-16728 CWE-707 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities