CVE-2024-47075: DOM Clobbering gadgets found in layui that lead to Cross-site Scripting

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-09-26 · updated 2026-06-17
Weakness: CWE-79

Description

LayUI is a native minimalist modular Web UI component library. Versions prior to 2.9.17 have a DOM Clobbering vulnerability that can lead to Cross-site Scripting (XSS) on web pages where attacker-controlled HTML elements (e.g., `img` tags with unsanitized `name` attributes) are present. Version 2.9.17 fixes this issue.

Affected products

layui: before 2.9.17 — fixed in 2.9.17

How to fix

Upgrade to a fixed version: layui 2.9.17. Check the vendor advisory for mitigations.

References

https://github.com/layui/layui/commit/f756b41d63bf3d488a2cb042918638c9851bf2b0
https://github.com/layui/layui/security/advisories/GHSA-j827-6rgf-9629

Get alerted when CVE-2024-47075 or the next vulnerability affects your stack