GitHub Advisoryadvisory · npm

GHSA-gjh4-fcv3-whpq Cross-Site Scripting in webtorrent

MEDIUM Published 2019-09-04 Modified 2021-08-17 Official page ↗
Aliases
CVE-2019-15782
Ecosystem
npm
Packages
webtorrent
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2019-09-03

Affected packages

• npm webtorrent: < 0.107.6 → fixed in 0.107.6

Description

Versions of `webtorrent` prior to 0.107.6 are vulnerable to Cross-Site Scripting. `webtorrent` servers started with `torrent.createServer()` lists a torrent's title and files in the index page without sanitization. This allows attackers to execute arbitrary JavaScript in the victim's browser through files with names containing the malicious payload. The issue is mitigated due to the fact that the server only allows fetching data pieces from the torrent. Recommendation Upgrade to version 0.107.6 or later.

Related

Alias · CVE (1)

  • CVE-2019-15782 WebTorrent before 0.107.6 allows XSS in the HTTP server via a title or file name. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References