GHSA-8cpw-73f2-w58m

Source

https://github.com/advisories/GHSA-8cpw-73f2-w58m

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/08/GHSA-8cpw-73f2-w58m/GHSA-8cpw-73f2-w58m.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-8cpw-73f2-w58m

Aliases

CVE-2019-15482

Published

2019-08-27T17:38:33Z

Modified

2023-11-08T04:01:13.250496Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Cross-Site Scripting in selectize-plugin-a11y

Details

Versions of selectize-plugin-a11y prior to 1.1.0 are vulnerable to Cross-Site Scripting. The accessibility.liveRegion.speak function does not sanitize the msg variable before rendering it as HTML. If this variable is controlled by user input it allows attackers to execute arbitrary JavaScript in a victim's browser.

Recommendation

Upgrade to version 1.1.0 or later.

Database specific

{
    "github_reviewed_at": "2019-08-27T17:01:49Z",
    "github_reviewed": true,
    "severity": "MODERATE",
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-79"
    ]
}

References

Affected packages

npm / selectize-plugin-a11y

Package

Name: selectize-plugin-a11y; View open source insights on deps.dev
Purl: pkg:npm/selectize-plugin-a11y

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.1.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/08/GHSA-8cpw-73f2-w58m/GHSA-8cpw-73f2-w58m.json"