GitHub Advisoryadvisory · npm
GHSA-pgr8-jg6h-8gw6 Cross-Site Scripting in webpack-bundle-analyzer
MEDIUM
Official page ↗
- Ecosystem
- npm
- Packages
- webpack-bundle-analyzer
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
- Weaknesses
- CWE-79
- Reviewed
- 2019-05-23
Affected packages
• npm webpack-bundle-analyzer: < 3.3.2 → fixed in 3.3.2
Description
Versions of `webpack-bundle-analyzer` prior to 3.3.2 are vulnerable to Cross-Site Scripting. The package uses `JSON.stringify()` without properly escaping input which may lead to Cross-Site Scripting.
Recommendation
Upgrade to version 3.3.2 or later.
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://github.com/webpack-contrib/webpack-bundle-analyzer/issues/263 web
- https://github.com/webpack-contrib/webpack-bundle-analyzer/pull/264 web
- https://github.com/webpack-contrib/webpack-bundle-analyzer/commit/20f2b4c553ee343f491faf63e39427fba9908c7c web
- https://snyk.io/vuln/SNYK-JS-WEBPACKBUNDLEANALYZER-174190 web
- https://www.npmjs.com/advisories/826 web