GitHub Advisoryadvisory · npm

GHSA-crfx-5phg-hmw9 Cross-Site Scripting in ids-enterprise

HIGH Published 2019-06-13 Modified 2020-08-31 Official page ↗
Ecosystem
npm
Packages
ids-enterprise
Severity
High
Weaknesses
CWE-79
Reviewed
2019-06-13

Affected packages

• npm ids-enterprise: < 4.18.2 → fixed in 4.18.2

Description

Versions of `ids-enterprise` prior to 4.18.2 are vulnerable to Cross-Site Scripting (XSS). Script tags in the `soho-autocomplete` component are not properly encoded and may allow attackers to execute arbitrary JavaScript. Recommendation Upgrade to version 4.18.2 or later

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References