GitHub Advisoryadvisory · npm

GHSA-g9wg-wq4f-2x5w Cross-Site Scripting in console-feed

HIGH Published 2020-09-03 Modified 2020-08-31 Official page ↗
Ecosystem
npm
Packages
console-feed
Severity
High
Weaknesses
CWE-79
Reviewed
2020-08-31

Affected packages

• npm console-feed: < 2.8.10 → fixed in 2.8.10

Description

Versions of `console-feed` prior to 2.8.10 are vulnerable to Cross-Site Scripting (XSS). The package fails to properly escape the rendered output. If an application uses `console-feed` and a malicious JavaScript payload was passed to a `console.log('%_', payload)` call, the package would render HTML containing the malicious payload. Recommendation Upgrade to version 2.8.10 or later.

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References