GitHub Advisoryadvisory · npm

GHSA-v5hp-35hw-cw5x XSS in client rendered block templates in rendr

HIGH Published 2020-09-01 Modified 2021-09-23 Official page ↗
Aliases
CVE-2016-1000230
Ecosystem
npm
Packages
rendr
Severity
High
Weaknesses
CWE-79
Reviewed
2020-08-31

Affected packages

• npm rendr: < 1.1.4 → fixed in 1.1.4

Description

Affected versions of `rendr` are vulnerable to cross-site scripting when client side rendering is done inside a `_block`. Server side rendering is not affected and is properly escaped. Recommendation Update to version 1.1.4 or later.

Related

Alias · not in database (1)

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References