cve/2025/CVE-2025-48050.md

CVE-2025-48050

Description

In DOMPurify through 3.2.5 before 6bc6d60, scripts/server.js does not ensure that a pathname is located under the current working directory. NOTE: the Supplier disputes the significance of this report because the "Uncontrolled data used in path expression" occurs "in a development helper script which starts a local web server if needed and must be manually started."

POC

Reference

• https://github.com/cure53/DOMPurify/pull/1101
• https://security.snyk.io/vuln/SNYK-JS-DOMPURIFY-10176060

Github

No PoCs found on GitHub currently.