GitHub Advisoryadvisory · npm

GHSA-f8rq-m28h-8hxj Cross-Site Scripting in htmr

HIGH Published 2020-09-03 Modified 2020-08-31 Official page ↗
Ecosystem
npm
Packages
htmr
Severity
High
Weaknesses
CWE-79
Reviewed
2020-08-31

Affected packages

• npm htmr: < 0.8.7 → fixed in 0.8.7

Description

Versions of `htmr` prior to 0.8.7 are vulnerable to Cross-Site Scripting (XSS). The package uses `innerHTML` to unescape HTML entities. This may lead to DOM-based XSS through HTML-encoded XSS payloads. This may allow an attacker to execute arbitrary JavaScript in a victim's browser. Recommendation Upgrade to version 0.8.7 or later.

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References