GitHub Advisoryadvisory · npm

GHSA-2qjp-fg8c-g878 vxe-table Cross-site Scripting vulnerability

LOW Published 2024-05-24 Modified 2024-05-24 Official page ↗
Aliases
CVE-2023-1001
Ecosystem
npm
Packages
vxe-table
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-05-24

Affected packages

• npm vxe-table: < 3.7.10 → fixed in 3.7.10

Description

A vulnerability, which was classified as problematic, has been found in xuliangzhan vxe-table up to 3.7.9. This issue affects the function export of the file packages/textarea/src/textarea.js of the component vxe-textarea. The manipulation of the argument inputValue leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 3.7.10 is able to address this issue. The patch is named d70b0e089740b65a22c89c106ebc4627ac48a22d. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-266123.

Related

Alias · CVE (1)

  • CVE-2023-1001 A vulnerability, which was classified as problematic, has been found in xuliangzhan vxe-table up to 3.7.9. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References