DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demonstrated by Chrome and Safari.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH     element, as demonstrated by Chrome and Safari. (CVE-2019-16728)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH
    element, as demonstrated by Chrome and Safari. (CVE-2019-16728)

Two issues have been found in dompurify.js, an XSS sanitizer for HTML, MathML and SVG.

Both issues are related to mXSS issues in SVG- or MATH-elements.

For Debian 9 stretch, these problems have been fixed in version 0.8.2~dfsg1-1+deb9u1.

We recommend that you upgrade your dompurify.js packages.

For the detailed security status of dompurify.js please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/dompurify.js

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
263049	Linux Distros Unpatched Vulnerability : CVE-2019-16728	Nessus	Misc.	medium
413926	SCA: security update for dompurify (GHSA-chqj-j4fh-rw7m)	Tenable Cloud Security	SCA Checks	medium
413926	SCA: security update for dompurify (GHSA-chqj-j4fh-rw7m)	Tenable Self-Hosted Container Security	SCA Checks	medium
142105	Debian DLA-2419-1 : dompurify.js security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2019-16728

medium

Tenable Plugins

medium

medium

medium

medium