GitHub Advisoryadvisory · npm

GHSA-cx3j-qqxj-9597 Critters Cross-site Scripting Vulnerability

MEDIUM Published 2023-08-11 Modified 2023-08-25 Official page ↗
Aliases
CVE-2023-3481
Ecosystem
npm
Packages
critters
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-116, CWE-79, CWE-80
Reviewed
2023-08-11

Affected packages

• npm critters: >= 0.0.17, < 0.0.20 → fixed in 0.0.20

Description

Impact Critters version 0.0.17-0.0.19 have an issue when parsing the HTML which leads to a potential cross-site scripting (XSS) bug. Patches The bug has been fixed in `v0.0.20`. Workarounds Upgrading Critters version to `>0.0.20` is the easiest fix. This is a non breaking version upgrade so we recommend all users to use `v0.0.20`.

Related

Alias · CVE (1)

  • CVE-2023-3481 Critters versions 0.0.17-0.0.19 have an issue when parsing the HTML, which leads to a potential cross-site scripting (XSS) bug. vulnerability

Weakness · CWE (3)

  • CWE-116 Improper Encoding or Escaping of Output weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness
  • CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page weakness

References