berslucas/liljs · Security
Cross-Site Scripting in @berslucas/liljs
- GHSA ID
- GHSA-c53x-wwx2-pg96
- Severity
- medium
- Published
- Updated
- CVSS
- 6.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- CVSS v3
- 6.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Description
Versions of @berslucas/liljs prior to 1.0.2 are vulnerable to Cross-Site Scripting (XSS). The package uses the unsafe innerHTML function without sanitizing input, which may allow attackers to execute arbitrary JavaScript on the victim's browser.
Recommendation
Upgrade to version 1.0.2 or later.
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
References
- https://snyk.io/vuln/SNYK-JS-BERSLUCASLILJS-450217 ↗
- https://www.npmjs.com/advisories/1016 ↗
- https://github.com/bersLucas/liljs/pull/7 ↗
- https://github.com/bersLucas/liljs/commit/779c0dcd8aba434a1c94db7d1d2d990a629f9a6c ↗
- https://github.com/bersLucas/liljs/releases/tag/1.0.2 ↗
- https://github.com/advisories/GHSA-c53x-wwx2-pg96 ↗