GitHub Advisoryadvisory · npm

GHSA-8p5p-ff7x-hw7q Cross-Site Scripting in public

MEDIUM Published 2018-10-10 Modified 2021-09-07 Official page ↗
Aliases
CVE-2018-3747
Ecosystem
npm
Packages
public
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2020-06-16

Affected packages

• npm public: < 0.1.4 → fixed in 0.1.4

Description

Versions of `public` prior to 0.1.4 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code. Recommendation Upgrade to version 0.1.4 or later.

Related

Alias · CVE (1)

  • CVE-2018-3747 The public node module versions <= 1.0.3 allows to embed HTML in file names, which (in certain conditions) might lead to execute malicious… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References