c3js/c3 · Security
Cross-Site Scripting in c3
- GHSA ID
- GHSA-gvg7-pp82-cff3
- CVE ID
- CVE-2016-1000240
- Severity
- medium
- Published
- Updated
Description
Affected versions of c3 are vulnerable to cross-site scripting via improper sanitization of HTML in rendered tooltips.
Recommendation
Update to 0.4.11 or later.
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')