juliushaertl/nextcloud-vue-collections · Security
Cross-Site Scripting in nextcloud-vue-collections
- GHSA ID
- GHSA-whv6-rj84-2vh2
- Severity
- high
- Published
- Updated
Description
Versions of nextcloud-vue-collections prior to 0.4.2 are vulnerable to Cross-Site Scripting (XSS). The v-tooltip component has an insecure defaultHTML configuration that allows arbitrary JavaScript to be injected in the tooltip of a collection item. This allows attackers to execute arbitrary code in a victim's browser.
Recommendation
Upgrade to version 0.4.2 or later.
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')