GitHub Advisoryadvisory · npm

GHSA-c7pp-g2v2-2766 DOM-based XSS in gmail-js

HIGH Published 2020-09-01 Modified 2021-09-23 Official page ↗
Aliases
CVE-2016-1000228
Ecosystem
npm
Packages
gmail-js
Severity
High
Weaknesses
CWE-79
Reviewed
2020-08-31

Affected packages

• npm gmail-js: < 0.6.5 → fixed in 0.6.5

Description

Affected versions of `gmail-js` are vulnerable to cross-site scripting in the `tools.parse_response`, `helper.get.visible_emails_post`, and `helper.get.email_data_post` functions, which pass user input directly into the Function constructor. Recommendation Update to version 0.6.5 or later.

Related

Alias · not in database (1)

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References