GitHub Advisoryadvisory · npm

GHSA-87mg-h5r3-hw88 Cross-Site Scripting in bootbox

MEDIUM Published 2019-05-30 Modified 2021-09-16 Official page ↗
Ecosystem
npm
Packages
bootbox
Severity
Moderate
Weaknesses
CWE-64, CWE-79
Reviewed
2019-05-30

Affected packages

• npm bootbox: <= 5.5.2 (no fix yet)

Description

All version of `bootbox` are vulnerable to Cross-Site Scripting. The package does not sanitize user input in the provided dialog boxes, allowing attackers to inject HTML code and execute arbitrary JavaScript. Recommendation Sanitize user input being passed to `bootbox` or consider using an alternative package.

Related

Weakness · CWE (2)

  • CWE-64 Windows Shortcut Following (.LNK) weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References