rendrjs/rendr-handlebars · Security
XSS in client rendered block templates in rendr
- GHSA ID
- GHSA-v5hp-35hw-cw5x
- CVE ID
- CVE-2016-1000230
- Severity
- high
- Published
- Updated
Description
Affected versions of rendr are vulnerable to cross-site scripting when client side rendering is done inside a _block.
Server side rendering is not affected and is properly escaped.
Recommendation
Update to version 1.1.4 or later.
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')