GitHub Advisoryadvisory · npm

GHSA-rv8p-rr2h-fgpg @apollo/experimental-nextjs-app-support Cross-site Scripting vulnerability

HIGH Published 2024-01-30 Modified 2024-01-30 Official page ↗
Aliases
CVE-2024-23841
Ecosystem
npm
Packages
@apollo/experimental-nextjs-app-support
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Weaknesses
CWE-80
Reviewed
2024-01-30

Affected packages

• npm @apollo/experimental-nextjs-app-support: < 0.7.0 → fixed in 0.7.0

Description

Impact The @apollo/experimental-apollo-client-nextjs NPM package is vulnerable to a cross-site scripting vulnerability. This vulnerability arises from improper handling of untrusted input when @apollo/experimental-apollo-client-nextjs performs server-side rendering of HTML pages. To fix this vulnerability, we implemented appropriate escaping to prevent javascript injection into rendered pages. Patches To fix this issue, please update to version 0.7.0 or later. Workarounds There are no known workarounds for this issue. Please update to version 0.7.0

Related

Alias · CVE (1)

  • CVE-2024-23841 apollo-client-nextjs is the Apollo Client support for the Next.js App Router. vulnerability

Weakness · CWE (1)

  • CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page weakness

References