CVE-2024-21541: dom-iterator code execution vulnerability
(updated )
Versions of the package dom-iterator before 1.0.1 are vulnerable to Arbitrary Code Execution due to use of the Function constructor without complete input sanitization. Function generates a new function body and thus care must be given to ensure that the inputs to Function are not attacker-controlled. The risks involved are similar to that of allowing attacker-controlled input to reach eval.
References
- github.com/advisories/GHSA-jrvm-mcxc-mf6m
- github.com/matthewmueller/dom-iterator
- github.com/matthewmueller/dom-iterator/commit/9e0e0fad5a251de5b42feb326c4204eb04080805
- nvd.nist.gov/vuln/detail/CVE-2024-21541
- security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8383166
- security.snyk.io/vuln/SNYK-JS-DOMITERATOR-6157199
Code Behaviors & Features
Detect and mitigate CVE-2024-21541 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →