GitHub Advisoryadvisory · npm
GHSA-c7pp-x73h-4m2v Cross-Site Scripting in bootstrap-vue
HIGH
Official page ↗
- Ecosystem
- npm
- Packages
- bootstrap-vue
- Severity
- High
- Weaknesses
- CWE-79
- Reviewed
- 2020-08-31
Affected packages
• npm bootstrap-vue: < 2.0.0-rc.12 → fixed in 2.0.0-rc.12
Description
Versions of `bootstrap-vue` prior to 2.0.0-rc.12 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization, components may be vulnerable to Cross-Site Scripting through the `options` variable. This may lead to the execution of malicious JavaScript on the user's browser.
Recommendation
Upgrade to version 2.0.0-rc.12 or later.
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://github.com/bootstrap-vue/bootstrap-vue/issues/1974 web
- https://github.com/bootstrap-vue/bootstrap-vue/pull/2134 web
- https://github.com/bootstrap-vue/bootstrap-vue/commit/ba6f3f8359e257589d744f180312c09bf9f12289 web
- https://github.com/bootstrap-vue/bootstrap-vue package
- https://www.npmjs.com/advisories/770 web