GitHub Advisoryadvisory · npm
GHSA-c53x-wwx2-pg96 Cross-Site Scripting in @berslucas/liljs
MEDIUM
Official page ↗
- Ecosystem
- npm
- Packages
- @berslucas/liljs
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-79
- Reviewed
- 2020-08-31
Affected packages
• npm @berslucas/liljs: < 1.0.2 → fixed in 1.0.2
Description
Versions of `@berslucas/liljs` prior to 1.0.2 are vulnerable to Cross-Site Scripting (XSS). The package uses the unsafe `innerHTML` function without sanitizing input, which may allow attackers to execute arbitrary JavaScript on the victim's browser.
Recommendation
Upgrade to version 1.0.2 or later.
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://github.com/bersLucas/liljs/pull/7 web
- https://github.com/bersLucas/liljs/commit/779c0dcd8aba434a1c94db7d1d2d990a629f9a6c web
- https://github.com/bersLucas/liljs package
- https://github.com/bersLucas/liljs/releases/tag/1.0.2 web
- https://snyk.io/vuln/SNYK-JS-BERSLUCASLILJS-450217 web
- https://www.npmjs.com/advisories/1016 web