GitHub Advisoryadvisory · npm

GHSA-whv6-rj84-2vh2 Cross-Site Scripting in nextcloud-vue-collections

HIGH Published 2020-09-04 Modified 2021-10-04 Official page ↗
Ecosystem
npm
Packages
nextcloud-vue-collections
Severity
High
Weaknesses
CWE-79
Reviewed
2020-08-31

Affected packages

• npm nextcloud-vue-collections: < 0.4.2 → fixed in 0.4.2

Description

Versions of `nextcloud-vue-collections` prior to 0.4.2 are vulnerable to Cross-Site Scripting (XSS). The `v-tooltip` component has an insecure `defaultHTML` configuration that allows arbitrary JavaScript to be injected in the tooltip of a collection item. This allows attackers to execute arbitrary code in a victim's browser. Recommendation Upgrade to version 0.4.2 or later.

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References