GitHub Advisoryadvisory · npm

GHSA-39cx-xcwj-3rc4 Cross-Site Scripting in dojo

MEDIUM Published 2020-09-01 Modified 2023-09-27 Official page ↗
Aliases
CVE-2008-6681
Ecosystem
npm
Packages
dojo
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2020-08-31

Affected packages

• npm dojo: < 1.1.0 → fixed in 1.1.0

Description

Affected versions of `dojo` are susceptible to a cross-site scripting vulnerability in the `dijit.Editor` and `textarea` components, which execute their contents as Javascript, even when sanitized. Recommendation Update to version 1.1.0 or later.

Related

Alias · CVE (1)

  • CVE-2008-6681 Cross-site scripting (XSS) vulnerability in dijit.Editor in Dojo before 1.1 allows remote attackers to inject arbitrary web script or HTML… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References