Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

Internet Explorer users vulnerable to malicious web scripting in HTML Purifier

CVE-2010-4183 · published 16 years ago
Summary

If you use Internet Explorer and have an outdated version of HTML Purifier, a malicious website could potentially inject code that affects your browser or computer. This affects how HTML Purifier handles certain CSS properties. Update to version 4.1.0 or later to protect against this risk.

What to do
  • Update ezyang htmlpurifier to version 4.1.0.
  • Update debian php-htmlpurifier to version 4.1.1+dfsg1-1.
Affected software
Ecosystem VendorProductAffected versions
composer ezyang htmlpurifier < 4.1.0
Fix: upgrade to 4.1.0
– htmlpurifier htmlpurifier <= 4.0.0
1.0.0
1.0.1
1.1.0
1.1.1
1.1.2
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
17 more version ranges
cpe:2.3:a:htmlpurifier:htmlpurifier:*:*:*:*:*:*:*:*
Debian:11 debian php-htmlpurifier < 4.1.1+dfsg1-1
Fix: upgrade to 4.1.1+dfsg1-1
Debian:12 debian php-htmlpurifier < 4.1.1+dfsg1-1
Fix: upgrade to 4.1.1+dfsg1-1
Original advisory text
Multiple cross-site scripting (XSS) vulnerabilities in HTML Purifier before 4.1.0, when Internet Explorer is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) ba...
Multiple cross-site scripting (XSS) vulnerabilities in HTML Purifier before 4.1.0, when Internet Explorer is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) background-image, (2) background, or (3) font-family Cascading Style Sheets (CSS) property, a different vulnerability than CVE-2010-2479.
References
Severity
4.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published5 Nov 2010
Updated3 Nov 2026
First seen6 Mar 2026
Sources
GHSA-3p68-m5qw-9g9w · GHSA
CVE-2010-4183 · NVD
DEBIAN-CVE-2010-4183 · OSV
Track software like this
Free during beta