GitHub Advisoryadvisory · npm

GHSA-pxcf-v868-m492 Injection and Cross-site Scripting in osm-static-maps

HIGH Published 2021-05-10 Modified 2023-09-11 Official page ↗
Aliases
CVE-2020-7749
Ecosystem
npm
Packages
osm-static-maps
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Weaknesses
CWE-74, CWE-79
Reviewed
2021-04-21

Affected packages

• npm osm-static-maps: < 3.9.0 → fixed in 3.9.0

Description

This affects all versions of package osm-static-maps under 3.9.0. User input given to the package is passed directly to a template without escaping `({{{ ... }}})`. As such, it is possible for an attacker to inject arbitrary HTML/JS code and depending on the context. It will be outputted as an HTML on the page which gives opportunity for XSS or rendered on the server (puppeteer) which also gives opportunity for SSRF and Local File Read.

Related

Alias · CVE (1)

  • CVE-2020-7749 This affects all versions of package osm-static-maps. vulnerability

Weakness · CWE (2)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References