GitHub Advisoryadvisory · npm
GHSA-v9wp-8r97-v6xg Cross-Site Scripting in jquery.json-viewer
HIGH
Official page ↗
- Ecosystem
- npm
- Packages
- jquery.json-viewer
- Severity
- High
- Weaknesses
- CWE-79
- Reviewed
- 2020-08-31
Affected packages
• npm jquery.json-viewer: < 1.3.0 → fixed in 1.3.0
Description
Versions of `jquery.json-viewer` prior to 1.3.0 are vulnerable to Cross-Site Scripting (XSS). The package insufficiently sanitizes user input when creating links, and concatenates the user input in an `` tag. This allows attackers to create malicious links with JSON payloads such as:
```
{
"foo": "https://bar.com\" onmouseover=alert('xss') \""
}
```
This may lead to arbitrary JavaScript execution in a victim's browser.
Recommendation
Upgrade to version 1.3.0 or later.
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness