-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from an incorrect template literal regex pattern in DOMPurify's sanitization logic. The commit diff shows the TMPLIT_EXPR regex was modified from /${[\w\W]}/gm to /${[\w\W]/gm, removing the closing brace requirement. This regex is used to detect and neutralize template literals in SAFE_FOR_TEMPLATES mode. The original pattern could be bypassed by payloads omitting the closing brace, allowing malicious content to persist through sanitization. The vulnerability is directly tied to this regex definition in src/regexp.ts, as confirmed by the patch and exploit analysis in referenced advisories.
JavaScriptJavaScript| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| dompurify | npm | < 3.2.4 | 3.2.4 |
Ongoing coverage of React2Shell