GitHub Advisoryadvisory · npm

GHSA-g3fq-3v3g-mh32 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in @nextcloud/dialogs

MEDIUM Published 2021-04-16 Modified 2021-04-13 Official page ↗
Aliases
CVE-2021-29438
Ecosystem
npm
Packages
@nextcloud/dialogs
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Weaknesses
CWE-79, CWE-80
Reviewed
2021-04-13

Affected packages

• npm @nextcloud/dialogs: < 3.1.2 → fixed in 3.1.2

Description

Impact The Nextcloud dialogs library before 3.1.2 did insufficiently escape text input passed to a toast. If your application displays toasts with user-supplied input, this could lead to a XSS vulnerability. _Note_: Nextcloud Server employs a strict Content Security Policy that mitigates the risk of these XSS vulnerabilities. Patches The vulnerability has been patched in version 3.1.2. If you need to display HTML in the toast, explicitly pass the `options.isHTML` config flag. Workarounds Make sure no user-supplied input flows into toasts.

Related

Alias · CVE (1)

  • CVE-2021-29438 The Nextcloud dialogs library (npm package @nextcloud/dialogs) before 3.1.2 insufficiently escaped text input passed to a toast. vulnerability

Weakness · CWE (2)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness
  • CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page weakness

References