GitHub Advisoryadvisory · npm

GHSA-9gr3-7897-pp7m XSS in Image Optimization API for Next.js

HIGH Published 2021-09-01 Modified 2021-08-31 Official page ↗
Aliases
CVE-2021-39178
Ecosystem
npm
Packages
next
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-79
Reviewed
2021-08-31

Affected packages

• npm next: >= 10.0.0, < 11.1.1 → fixed in 11.1.1

Description

Impact • Affected: All of the following must be true to be affected • Next.js between version 10.0.0 and 11.1.0 • The `next.config.js` file has `images.domains` array assigned • The image host assigned in `images.domains` allows user-provided SVG • Not affected: The `next.config.js` file has `images.loader` assigned to something other than default • Not affected: Deployments on Vercel are not affected Patches Next.js v11.1.1

Related

Alias · CVE (1)

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References