GitHub Advisoryadvisory · npm

GHSA-r9q4-w3fm-wrm2 Cross-Site Scripting in google-closure-library

MEDIUM Published 2020-09-02 Modified 2021-09-27 Official page ↗
Ecosystem
npm
Packages
google-closure-library
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2020-08-31

Affected packages

• npm google-closure-library: < 20190301.0.0 → fixed in 20190301.0.0

Description

Versions of `google-closure-library` prior to 20190301.0.0 are vulnerable to Cross-Site Scripting. The `safedomtreeprocessor.processToString()` function improperly processed empty elements, which could allow attackers to execute arbitrary JavaScript through Mutation Cross-Site Scripting. Recommendation Upgrade to version 20190301.0.0 or later.

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References