What is GHSA-8hgg-xxm5-3873?

GHSA-8hgg-xxm5-3873 is a security advisory published by GitHub Security Advisories with Medium severity. DOMPurify Open Redirect vulnerability

Which CVE IDs does GHSA-8hgg-xxm5-3873 cover?

GHSA-8hgg-xxm5-3873 covers the following CVE IDs: CVE-2019-25155. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-8hgg-xxm5-3873?

GHSA-8hgg-xxm5-3873 has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-8hgg-xxm5-3873?

GHSA-8hgg-xxm5-3873 affects 1 product, including: npm/dompurify:\u003c 1.0.11.

GHSA-8hgg-xxm5-3873MediumCVSS 6.1

DOMPurify Open Redirect vulnerability

Vendor

GitHub Security Advisories

Published

November 14, 2023

Last Modified

November 15, 2023

🔗 CVE IDs covered (1)

CVE-2019-25155 →

📋 Description

DOMPurify before 1.0.11 allows reverse tabnabbing in demos/hooks-target-blank-demo.html because links lack a 'rel="noopener noreferrer"' attribute.

🎯 Affected products1

npm/dompurify:< 1.0.11

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2019-25155
https://github.com/cure53/DOMPurify/compare/1.0.10...1.0.11
https://github.com/cure53/DOMPurify/pull/337
https://github.com/cure53/DOMPurify/commit/7601c33a57e029cce51d910eda5179a3f1b51c83
https://github.com/advisories/GHSA-8hgg-xxm5-3873