GitHub Advisoryadvisory · npm

GHSA-mpjf-8cmf-p789 Cross-Site Scripting in jingo

HIGH Published 2020-09-01 Modified 2020-08-31 Official page ↗
Ecosystem
npm
Packages
jingo
Severity
High
Weaknesses
CWE-79
Reviewed
2020-08-31

Affected packages

• npm jingo: < 1.9.2 → fixed in 1.9.2

Description

Versions of `jingo` prior to 1.9.2 are vulnerable to Cross-Site Scripting (XSS). If malicious input such as `alert(1)` is placed in the content of a wiki page, Jingo does not properly encode the input and it is executed instead of rendered as text. Recommendation Upgrade to version 1.9.2

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References