GitHub Advisoryadvisory · Go

GHSA-jpj5-hg26-6jgc Cross-site Scripting in Alist

MEDIUM Published 2022-03-13 Modified 2022-03-23 Official page ↗
Aliases
CVE-2022-26533
Ecosystem
Go
Packages
github.com/Xhofe/alist
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-03-23

Affected packages

• Go github.com/Xhofe/alist: >= 2.0.10, < 2.1.1 → fixed in 2.1.1

Description

Alist versions 2.0.10 through 2.1.0 were discovered to contain a cross-site scripting (XSS) vulnerability via /i/:data/ipa.plist. This issue was fixed in version 2.1.1.

Related

Alias · CVE (1)

  • CVE-2022-26533 Alist v2.1.0 and below was discovered to contain a cross-site scripting (XSS) vulnerability via /i/:data/ipa.plist. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References