GitHub Advisoryadvisory · npm

GHSA-hgr5-82rc-p936 Cross-Site Scripting in md-data-table

HIGH Published 2020-09-01 Modified 2020-08-31 Official page ↗
Ecosystem
npm
Packages
md-data-table
Severity
High
Weaknesses
CWE-79
Reviewed
2020-08-31

Affected packages

• npm md-data-table: >= 0.0.0 (no fix yet)

Description

All versions of `md-data-table` are vulnerable to cross-site scripting (XSS). This vulnerability is exploitable if an attacker has control over data that is rendered by `mdt-row` Recommendation As there is no fix for this vulnerability at this time we recommend either selecting another package to perform this functionality or properly sanitizing all user data prior to rendering with `md-data-table`

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References