GitHub Advisoryadvisory · npm

GHSA-788m-pj96-7w2c Cross-Site Scripting in fomantic-ui

HIGH Published 2020-09-02 Modified 2021-09-27 Official page ↗
Ecosystem
npm
Packages
fomantic-ui
Severity
High
Weaknesses
CWE-79
Reviewed
2020-08-31

Affected packages

• npm fomantic-ui: < 2.7.0 → fixed in 2.7.0

Description

Versions of `fomantic-ui` are vulnerable to Cross-Site Scripting. Lack of output encoding on the selection dropdowns can lead to user input being executed instead of printed as text. Recommendation Upgrade to version 2.7.0 or later.

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References