GitHub Advisoryadvisory · npm

GHSA-vwhg-jwr4-vxgg gettext.js has a Cross-site Scripting injection

HIGH Published 2024-08-15 Modified 2024-08-16 Official page ↗
Aliases
CVE-2024-43370
Ecosystem
npm
Packages
gettext.js
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-08-15

Affected packages

• npm gettext.js: < 2.0.3 → fixed in 2.0.3

Description

Impact Possible vulnerability to XSS injection if .po dictionary definition files is corrupted Patches Update gettext.js to 2.0.3 Workarounds Make sure you control the origin of the definition catalog to prevent the use of this flaw in the definition of plural forms.

Related

Alias · CVE (1)

  • CVE-2024-43370 gettext.js is a GNU gettext port for node and the browser. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References