GitStock

risingstack/protect · Security

Cross-Site Scripting in @risingstack/protect

GHSA ID
GHSA-vpch-rxw3-fgx8
CVE ID
CVE-2018-1000160
Severity
medium
Published
Updated
CVSS
6.1 · CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v3
6.1 · CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

All versions of @risingstack/protect are vulnerable to Cross-Site Scripting. The isXss() XSS validator has several bypasses that may allow attackers to execute arbitrary JavaScript in a victim's browser.

Recommendation

No fix is currently available. Consider using an alternative package. The package is not actively maintained and will not be patched.

CWEs

  • CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

References