GitHub Advisoryadvisory · npm

GHSA-vqr3-vrrg-f3jh NodeBB Cross-site scripting (XSS) vulnerability

MEDIUM Published 2025-01-24 Modified 2025-02-07 Official page ↗
Aliases
CVE-2024-57041
Ecosystem
npm
Packages
nodebb
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2025-02-07

Affected packages

• npm nodebb: < 3.11.1 → fixed in 3.11.1

Description

A persistent cross-site scripting (XSS) vulnerability in NodeBB v3.11.0 allows remote attackers to store arbitrary code in the 'about me' section of their profile.

Related

Alias · CVE (1)

  • CVE-2024-57041 A persistent cross-site scripting (XSS) vulnerability in NodeBB v3.11.0 allows remote attackers to store arbitrary code in the 'about me'… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References