CVE-2025-48050: 
Grafana vulnerability analysis and mitigation

CVE-2025-48050 affects DOMPurify through version 3.2.5 (before commit 6bc6d60). The vulnerability exists in scripts/server.js where the application does not ensure that a pathname is located under the current working directory. This issue was discovered and disclosed on May 15, 2025. Notably, the vulnerability is disputed by the supplier, who argues that the issue only exists in a development helper script that requires manual activation (NVD, Wiz).

The vulnerability is classified as a Path Traversal issue (CWE-24) with a CVSS v3.1 base score of 7.5 (HIGH). The vulnerability vector string is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N, indicating network accessibility with high attack complexity, no privileges required, and no user interaction needed. The vulnerability allows for potential directory traversal through improper path validation in the server.js script (NVD, Snyk).

The vulnerability could potentially allow attackers to access files outside the intended directory through path manipulation. This could result in unauthorized access to sensitive information or arbitrary file deletion via crafted input. However, the impact is limited as the vulnerability only exists in a development helper script (Snyk).

The vulnerability has been fixed in commit 6bc6d60 by implementing proper path validation. The fix includes normalizing the path using path.resolve, using fs.realpathSync to resolve symbolic links, and verifying that the resolved path starts with the intended root directory. If the resolved path does not start with the root directory, the request is rejected with a 403 Forbidden status code (GitHub Commit).

The vulnerability has generated significant discussion within the security community, with the DOMPurify maintainers strongly disputing its severity. The project maintainer has stated that this is not a vulnerability as it only affects a development helper script and was created without proper coordination. The CVE was later disputed by the supplier (GitHub PR).