GitHub Advisoryadvisory · npm

GHSA-9xr8-8hmc-389f Cross-Site Scripting in vant

HIGH Published 2019-11-22 Modified 2021-08-18 Official page ↗
Ecosystem
npm
Packages
vant
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-79
Reviewed
2019-11-21

Affected packages

• npm vant: < 2.1.8 → fixed in 2.1.8

Description

Versions of `vant` prior to 2.1.8 are vulnerable to Cross-Site Scripting. The text value of the `Picker` component column is not sanitized, which may allow attackers to execute arbitrary JavaScript in a victim's browser. Recommendation Upgrade to version 2.1.8 or later.

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References