GHSA-26q7-g57v-mxcp

Source

https://github.com/advisories/GHSA-26q7-g57v-mxcp

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/11/GHSA-26q7-g57v-mxcp/GHSA-26q7-g57v-mxcp.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-26q7-g57v-mxcp

Aliases

CVE-2017-16043

Published

2018-11-07T00:28:11Z

Modified

2023-11-08T03:59:01Z

Summary

HTML Injection in shout

Details

Affected versions of shout do not escape the /topic command in messages, and are therefore vulnerable to cross-site scripting.

Recommendation

Update to version 0.50.0 or later.

Database specific

{
    "cwe_ids":  [
        "CWE-80"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-06-16T20:51:31Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

Affected packages

npm / shout

Package

Name: shout; View open source insights on deps.dev
Purl: pkg:npm/shout

Affected ranges

Type: SEMVER
Events: Introduced

0.44.0

Fixed

0.50.0

Database specific

last_known_affected_version_range

"<= 0.49.3"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/11/GHSA-26q7-g57v-mxcp/GHSA-26q7-g57v-mxcp.json"