CVE-2024-21541: dom-iterator Arbitrary Code Execution Vulnerability with PoC

Key Information Vulnerability Description Name: Arbitrary Code Execution Affected Package: dom-iterator Affected Versions: All versions Introduced Date: January 15, 2024 CVE ID: CVE-2024-21541 CWE ID: CWE-94 First Discovered By: Snyk Vulnerability Type Severity: Medium (6.9) Threat Intelligence: Proof of Concept Vulnerability Impact Description: dom-iterator is a feature-rich iterator used for traversing DOM nodes. Cause: Due to the use of the constructor without complete input sanitization, affected versions are vulnerable to arbitrary code execution attacks. Proof of Concept Code CVSS Score Version 4.0: 6.9 (Medium) Version 3.1: 6.9 (Medium) Additional Information Snyk ID: SNYK-JS-DOMITERATOR-6157199 Published Date: November 12, 2024 Disclosure Date: January 15, 2024 Contributor: NodeMedic-FINE Remediation Recommendation: No fixed version is currently available. How to Fix: Since no fixed version is available, it is recommended to implement alternative security measures, such as updating to the latest version of the dependency. Contact Information Report New Vulnerability: Report New Vulnerability Found an Error: Report an Error Additional Resources Learn: Interactive course on Arbitrary Code Execution vulnerabilities Test Your App: Test your application to check for affected components Snyk Learn: Learn how to use Snyk tools for security scanning and vulnerability management Company Information Snyk Limited Company Registration Number: 09677925 Registered Address: High House, Basingstoke Road, Spencer Wood, Reading, Berkshire, RG7 1NT

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2024-21541: dom-iterator Arbitrary Code Execution Vulnerability with PoC