sstephenson/eco · Security
Cross-Site Scripting in eco
- GHSA ID
- GHSA-r32x-jhw5-g48p
- Severity
- high
- Published
- Updated
Description
All versions of eco are vulnerable to Cross-Site Scripting (XSS). The package's default __escape implementation fails to escape single quotes, which may allow attackers to execute arbitrary JavaScript on the victim's browser.
Recommendation
No fix is currently available. Consider using an alternative package until a fix is made available.
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')