GitHub Advisoryadvisory · npm

GHSA-5p26-hw7f-3cpr Cross-Site Scripting in html-pages

MEDIUM Published 2019-02-07 Modified 2023-09-12 Official page ↗
Aliases
CVE-2018-16481
Ecosystem
npm
Packages
html-pages
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-64, CWE-79
Reviewed
2020-06-16

Affected packages

• npm html-pages: <= 3.1.0 (no fix yet)

Description

All versions of `html-pages` are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize folder names, allowing attackers to execute arbitrary JavaScript in the victim's browser through folders with names containing malicious code. Recommendation No fix is currently available. Consider using an alternative package until a fix is made available.

Related

Alias · CVE (1)

  • CVE-2018-16481 A XSS vulnerability was found in html-page <=2.1.1 that allows malicious Javascript code to be executed in the user's browser due to the… vulnerability

Weakness · CWE (2)

  • CWE-64 Windows Shortcut Following (.LNK) weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References