kartiktalwar/gmail.js · Security
DOM-based XSS in gmail-js
- GHSA ID
- GHSA-c7pp-g2v2-2766
- CVE ID
- CVE-2016-1000228
- Severity
- high
- Published
- Updated
Description
Affected versions of gmail-js are vulnerable to cross-site scripting in the tools.parse_response, helper.get.visible_emails_post, and helper.get.email_data_post functions, which pass user input directly into the Function constructor.
Recommendation
Update to version 0.6.5 or later.
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')