CVE-2024-48910 is a prototype pollution vulnerability in DOMPurify, a core sanitization library used in Red Hat OpenShift Container Platform. The flaw allows remote attackers to add or modify attributes on the prototype of JavaScript objects, which can lead to injection of malicious attributes or cause application crashes by overriding existing attributes with incompatible types. This impacts the integrity and availability of applications relying on DOMPurify for sanitization. Red Hat classifies this vulnerability as high severity and has released updated container images and packages in OpenShift Container Platform 4.20.1 to address it. No effective mitigation other than upgrading is currently available according to Red Hat Product Security.

The vulnerability allows attackers to modify the prototype of built-in JavaScript objects, potentially enabling them to manipulate application behavior, bypass security controls, or cause denial of service via crashes. Since DOMPurify is used to sanitize user input, exploitation could lead to execution of malicious scripts or other unintended behaviors across the application. Red Hat rates the impact as high severity with integrity and availability impacts. There are no known exploits in the wild at this time.

Red Hat advises all users of affected OpenShift Container Platform versions to upgrade to the updated packages and container images containing the fix for CVE-2024-48910. No other mitigations meeting Red Hat's criteria for ease of use, applicability, and stability are currently available. Users should monitor Red Hat advisories for the release of updated images and packages and follow official upgrade instructions to apply the fix.