FKIE_CVE-2025-48050

Vulnerability from fkie_nvd - Published: 2025-05-15 16:15 - Updated: 2026-06-17 09:29
Severity
7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N
Summary
In DOMPurify through 3.2.5 before 6bc6d60, scripts/server.js does not ensure that a pathname is located under the current working directory. NOTE: the Supplier disputes the significance of this report because the "Uncontrolled data used in path expression" occurs "in a development helper script which starts a local web server if needed and must be manually started."
References
cve@mitre.orghttps://github.com/cure53/DOMPurify/commit/6bc6d60e49256f27a4022181b7d8a5b0721fd534
cve@mitre.orghttps://github.com/cure53/DOMPurify/pull/1101
cve@mitre.orghttps://github.com/odaysec/advisory/blob/main/cure53/DOMPurify/writeup.md
cve@mitre.orghttps://security.snyk.io/vuln/SNYK-JS-DOMPURIFY-10176060
134c704f-9b21-4f2e-91b3-4a467353bcc0https://github.com/cure53/DOMPurify/pull/1101
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unknown",
          "product": "DOMPurify",
          "vendor": "Cure53",
          "versions": [
            {
              "lessThanOrEqual": "3.2.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "cveTags": [
    {
      "sourceIdentifier": "cve@mitre.org",
      "tags": [
        "disputed"
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In DOMPurify through 3.2.5 before 6bc6d60, scripts/server.js does not ensure that a pathname is located under the current working directory. NOTE: the Supplier disputes the significance of this report because the \"Uncontrolled data used in path expression\" occurs \"in a development helper script which starts a local web server if needed and must be manually started.\""
    },
    {
      "lang": "es",
      "value": "En DOMPurify hasta 3.2.5 antes de 6bc6d60, scripts/server.js no garantiza que una ruta est\u00e9 ubicada bajo el directorio de trabajo actual."
    }
  ],
  "id": "CVE-2025-48050",
  "lastModified": "2026-06-17T09:29:04.040",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 4.7,
        "source": "cve@mitre.org",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-48050",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-05-15T19:14:45.450586Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-05-15T16:15:34.410",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "https://github.com/cure53/DOMPurify/commit/6bc6d60e49256f27a4022181b7d8a5b0721fd534"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://github.com/cure53/DOMPurify/pull/1101"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://github.com/odaysec/advisory/blob/main/cure53/DOMPurify/writeup.md"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://security.snyk.io/vuln/SNYK-JS-DOMPURIFY-10176060"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/cure53/DOMPurify/pull/1101"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-24"
        }
      ],
      "source": "cve@mitre.org",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.