mbraak/jqtree · Security
Cross-Site Scripting in jqtree
- GHSA ID
- GHSA-gjhx-gxwx-jx9j
- CVE ID
- CVE-2016-1000234
- Severity
- high
- Published
- Updated
Description
Affected versions of jqtree are vulnerable to cross-site scripting in the drag and drop functionality for modifying tree data.
When a user attempts to drag a node to a different position in the hierarchy, script content existing within the node will be executed.
Recommendation
Update to 1.3.4 or later.
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')