GHSA-r3xc-47qg-h929 Cross-Site Scripting in @ionic/core

• npm @ionic/core: < 4.0.3 → fixed in 4.0.3 • npm @ionic/core: >= 4.1.0, < 4.1.3 → fixed in 4.1.3 • npm @ionic/core: >= 4.2.0, < 4.2.1 → fixed in 4.2.1 • npm @ionic/core: >= 4.3.0, < 4.3.1 → fixed in 4.3.1

Versions of `@ionic/core` prior to 4.0.3, 4.1.3, 4.2.1 or 4.3.1 are vulnerable to Cross-Site Scripting (XSS). The package uses the unsafe `innerHTML` function without sanitizing input, which may allow attackers to execute arbitrary JavaScript on the victim's browser. This issue affects the components: • `.message` • `.placeholder` • `.loadingText` • `.pullingText` • `.refershingText` Recommendation • If you are using @ionic/core 4.0.x, upgrade to 4.0.3 or later. • If you are using @ionic/core 4.1.x, upgrade to 4.1.3 or later. • If you are using @ionic/core 4.2.x, upgrade to 4.2.1 or later. • If you are using @ionic/core 4.3.x, upgrade to 4.3.1 or later.