GitHub Advisoryadvisory · npm

GHSA-jj6g-7j8p-7gf2 Cross-Site Scripting in bracket-template

HIGH Published 2019-05-30 Modified 2020-08-31 Official page ↗
Ecosystem
npm
Packages
bracket-template
Severity
High
Weaknesses
CWE-79
Reviewed
2019-05-30

Affected packages

• npm bracket-template: <= 1.1.5 (no fix yet)

Description

All versions of `bracket-template` are vulnerable to stored cross-site scripting (XSS). This is exploitable when a variable passed in via a GET parameter is used in a template. Recommendation No fix is currently available for this vulnerability. It is our recommendation to not install or use this module at this time.

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References