GitHub Advisoryadvisory · npm
GHSA-26q7-g57v-mxcp HTML Injection in shout
MEDIUM
Official page ↗
- Aliases
- CVE-2017-16043
- Ecosystem
- npm
- Packages
- shout
- Severity
- Moderate
- Weaknesses
- CWE-80
- Reviewed
- 2020-06-16
Affected packages
• npm shout: >= 0.44.0, < 0.50.0 → fixed in 0.50.0
Description
Affected versions of `shout` do not escape the `/topic` command in messages, and are therefore vulnerable to cross-site scripting.
Recommendation
Update to version 0.50.0 or later.
Related
Alias · CVE (1)
- CVE-2017-16043 Shout is an IRC client. vulnerability
Weakness · CWE (1)
- CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page weakness