makeusabrew/bootbox · Security
Cross-Site Scripting in bootbox
- GHSA ID
- GHSA-87mg-h5r3-hw88
- Severity
- medium
- Published
- Updated
Description
All version of bootbox are vulnerable to Cross-Site Scripting. The package does not sanitize user input in the provided dialog boxes, allowing attackers to inject HTML code and execute arbitrary JavaScript.
Recommendation
Sanitize user input being passed to bootbox or consider using an alternative package.
CWEs
- CWE-64 · Windows Shortcut Following (.LNK)
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')