GitHub Advisoryadvisory · npm

GHSA-gjhx-gxwx-jx9j Cross-Site Scripting in jqtree

HIGH Published 2020-09-01 Modified 2021-09-23 Official page ↗
Aliases
CVE-2016-1000234
Ecosystem
npm
Packages
jqtree
Severity
High
Weaknesses
CWE-79
Reviewed
2020-08-31

Affected packages

• npm jqtree: < 1.3.4 → fixed in 1.3.4

Description

Affected versions of `jqtree` are vulnerable to cross-site scripting in the drag and drop functionality for modifying tree data. When a user attempts to drag a node to a different position in the hierarchy, script content existing within the node will be executed. Recommendation Update to 1.3.4 or later.

Related

Alias · not in database (1)

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References