GitHub Advisoryadvisory · npm

GHSA-2hwp-g4g7-mwwj Reflected Cross-Site Scripting in jquery.terminal

MEDIUM Published 2019-05-29 Modified 2020-08-31 Official page ↗
Ecosystem
npm
Packages
jquery.terminal
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2019-05-29

Affected packages

• npm jquery.terminal: < 1.21.0 → fixed in 1.21.0

Description

Versions of `jquery.terminal` prior to 1.21.0 are vulnerable to Reflected Cross-Site Scripting. If the application has either of the options `anyLinks` or `invokeMethods` set to true, the application may execute arbitrary JavaScript through crafted malicious payloads due to insufficient sanitization. Recommendation Upgrade to version 1.21.0 or later

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References