guillaumepotier/gettext.js · Security
gettext.js has a Cross-site Scripting injection
- GHSA ID
- GHSA-vwhg-jwr4-vxgg
- CVE ID
- CVE-2024-43370
- Severity
- high
- Published
- Updated
- CVSS
- 7.2 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- CVSS v3
- 7.2 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Description
Impact
Possible vulnerability to XSS injection if .po dictionary definition files is corrupted
Patches
Update gettext.js to 2.0.3
Workarounds
Make sure you control the origin of the definition catalog to prevent the use of this flaw in the definition of plural forms.
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')