Description
DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demonstrated by Chrome and Safari.
Remediation
References
https://lists.debian.org/debian-lts-announce/2020/10/msg00029.html
https://research.securitum.com/dompurify-bypass-using-mxss/
Related Vulnerabilities
CVE-2020-2198 Vulnerability in maven package hudson.plugins:project-inheritance
CVE-2014-3600 Vulnerability in maven package org.apache.activemq:activemq-broker
CVE-2020-1936 Vulnerability in maven package org.apache.ambari:ambari-web
CVE-2022-25929 Vulnerability in npm package smoothie
CVE-2022-21169 Vulnerability in npm package express-xss-sanitizer