GitHub Advisoryadvisory · npm

GHSA-w4vp-3mq7-7v82 Cross-Site Scripting in lazysizes

HIGH Published 2020-09-03 Modified 2020-08-31 Official page ↗
Ecosystem
npm
Packages
lazysizes
Severity
High
Weaknesses
CWE-79
Reviewed
2020-08-31

Affected packages

• npm lazysizes: < 5.2.1-rc1 → fixed in 5.2.1-rc1

Description

Versions of `lazysizes` prior to 5.2.1-rc1 are vulnerable to Cross-Site Scripting. The `video-embed` plugin fails to sanitize the following attributes: data-vimeo, `data-vimeoparams`, `data-youtube` and `data-ytparams`. This allows attackers to execute arbitrary JavaScript in a victim's browser if the attacker has control over the vulnerable attributes. Recommendation Upgrade to version 5.2.1-rc1 or later.

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References