Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.8
CVE-2024-47075: Layui before 2.9.17 can run attacker code via page elements
CVE-2024-47075 · published 2 years ago
Summary
The Layui JavaScript library versions earlier than 2.9.17 let specially crafted HTML tags insert malicious scripts into a web page. This could let an attacker execute code in the browser of anyone who visits the affected site. Update Layui to version 2.9.17 or later to stop the risk.
What to do
- Update sentsim layui to version 2.9.17.
- Update layui layui to version 2.9.17 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | sentsim | layui |
< 2.9.17 Fix: upgrade to 2.9.17
|
| – | layui | layui |
< 2.9.17 cpe:2.3:a:layui:layui:*:*:*:*:*:*:*:* |
Original advisory text
DOM Clobbering gadgets found in layui that lead to Cross-site Scripting
LayUI is a native minimalist modular Web UI component library. Versions prior to 2.9.17 have a DOM Clobbering vulnerability that can lead to Cross-site Scripting (XSS) on web pages where attacker-controlled HTML elements (e.g., `img` tags with unsanitized `name` attributes) are present. Version 2.9.17 fixes this issue.
References
- https://layui.dev/notes/share/security-currentscript.html
- https://github.com/advisories/GHSA-j827-6rgf-9629
- https://github.com/layui/layui/security/advisories/GHSA-j827-6rgf-9629 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-47075 Vendor Advisory
- https://github.com/layui/layui/commit/f756b41d63bf3d488a2cb042918638c9851bf2b0 Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47075... Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published26 Sep 2024
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta