GitHub Advisoryadvisory · npm

GHSA-4g46-5grc-wq49 Cross-Site Scripting in seeftl

HIGH Published 2020-04-01 Modified 2020-08-31 Official page ↗
Aliases
CVE-2019-15603
Ecosystem
npm
Packages
seeftl
Severity
High
Weaknesses
CWE-79
Reviewed
2020-04-01

Affected packages

• npm seeftl: <= 0.1.1 (no fix yet)

Description

All versions of `seeftl` are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code. Recommendation No fix is currently available. Consider using an alternative package until a fix is made available.

Related

Alias · CVE (1)

  • CVE-2019-15603 The seefl package v0.1.1 is vulnerable to a stored Cross-Site Scripting (XSS) vulnerability via a malicious filename rendered in a… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References