GitHub Advisoryadvisory · npm

GHSA-w4v7-hwx7-9929 Cross-site Scripting in tempura

MEDIUM Published 2021-11-08 Modified 2021-11-08 Official page ↗
Aliases
CVE-2021-23784
Ecosystem
npm
Packages
tempura
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2021-11-04

Affected packages

• npm tempura: < 0.4.0 → fixed in 0.4.0

Description

This affects the package tempura before 0.4.0. If the input to the esc function is of type object (i.e an array) it is returned without being escaped/sanitized, leading to a potential Cross-Site Scripting vulnerability.

Related

Alias · CVE (1)

  • CVE-2021-23784 This affects the package tempura before 0.4.0. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References