GitHub Advisoryadvisory · npm

GHSA-vp4f-wxgw-7x8x Improper Neutralization of Script in Attributes in @dcl/single-sign-on-client

HIGH Published 2023-09-04 Modified 2023-09-04 Official page ↗
Aliases
CVE-2023-41049
Ecosystem
npm
Packages
@dcl/single-sign-on-client
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-79
Reviewed
2023-09-04

Affected packages

• npm @dcl/single-sign-on-client: < 0.1.0 → fixed in 0.1.0

Description

Impact Improper input validation in the `init` function allows arbitrary javascript to be executed using the `javascript:` prefix ```ts SSO.init('javascript:alert("javascript successfully injected")') ``` Patches This vulnerability was patched on version `0.1.0` Workarounds This vulnerability can be prevented if user input correctly sanitized or there is no user input pass to the `init` function

Related

Alias · CVE (1)

  • CVE-2023-41049 @dcl/single-sign-on-client is an open source npm library which deals with single sign on authentication flows. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References