google/closure-library · Security
Cross-Site Scripting in google-closure-library
- GHSA ID
- GHSA-r9q4-w3fm-wrm2
- Severity
- medium
- Published
- Updated
Description
Versions of google-closure-library prior to 20190301.0.0 are vulnerable to Cross-Site Scripting. The safedomtreeprocessor.processToString() function improperly processed empty elements, which could allow attackers to execute arbitrary JavaScript through Mutation Cross-Site Scripting.
Recommendation
Upgrade to version 20190301.0.0 or later.
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')