CVE-2024-47075: Layui has DOM Clobbering gadgets that leads to Cross-site Scripting

September 26, 2024 (updated August 15, 2025)

A DOM Clobbering vulnerability has been discovered in layui that can lead to Cross-site Scripting (XSS) on web pages where attacker-controlled HTML elements (e.g., img tags with unsanitized name attributes) are present.

It’s worth noting that we’ve identifed similar issues in other popular client-side libraries like Webpack (CVE-2024-43788) and Vite (CVE-2024-45812), which might serve as valuable references.

References

github.com/advisories/GHSA-j827-6rgf-9629
github.com/layui/layui
github.com/layui/layui/commit/f756b41d63bf3d488a2cb042918638c9851bf2b0
github.com/layui/layui/security/advisories/GHSA-j827-6rgf-9629
layui.dev/notes/share/security-currentscript.html
nvd.nist.gov/vuln/detail/CVE-2024-47075

Code Behaviors & Features

Detect and mitigate CVE-2024-47075 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →