GitHub Advisoryadvisory · npm

GHSA-p9vv-3945-x93h Cross-Site Scripting in semantic-ui-search

HIGH Published 2020-09-02 Modified 2021-09-27 Official page ↗
Ecosystem
npm
Packages
semantic-ui-search
Severity
High
Weaknesses
CWE-79
Reviewed
2020-08-31

Affected packages

• npm semantic-ui-search: all versions (no fix yet)

Description

All versions of `semantic-ui-search` are vulnerable to Cross-Site Scripting. Lack of output encoding on the selection dropdowns can lead to user input being executed instead of printed as text. Recommendation No fix is currently available. Consider using an alternative module until a fix is made available.

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References