Skip to content

DOMPurify 2.0.16

Choose a tag to compare

View all tags
@cure53 cure53 released this 18 Sep 12:30
· 1022 commits to main since this release
2.0.16
63061bf
This commit was signed with the committer’s verified signature.
cure53 Cure53
GPG key ID: 5F0CDACD24BB6BF4
Verified
Learn about vigilant mode.
  • Fixed an mXSS-based bypass caused by nested forms inside MathML
  • Fixed a security error thrown on older Chrome on Android versions, see #470

Credits for the bypass go to Michał Bentkowski (@securityMB) of Securitum who spotted the bug in Chrome, turned it into another DOMPurify bypass, reported and helped verifying the fix 🙇‍♂️ 🙇‍♀️

Assets 2
Loading