GHSA-5634-rv46-48jf
Suggest an improvement- Source
- https://github.com/advisories/GHSA-5634-rv46-48jf
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-5634-rv46-48jf/GHSA-5634-rv46-48jf.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-5634-rv46-48jf
- Published
- 2020-09-03T17:13:45Z
- Modified
- 2020-08-31T18:44:51Z
- Summary
- Cross-Site Scripting in bleach
- Details
-
All versions of
bleachare vulnerable to Cross-Site Scripting. It is possible to bypass the package's HTML sanitization with payloads such as"<<script><</script>script>alert('xss');</<script><</script>script>"regardless of the passed options. This may allow attackers to execute arbitrary JavaScript in the victim's browser.Recommendation
No fix is currently available. Consider using an alternative package until a fix is made available.
- Database specific
{ "cwe_ids": [ "CWE-79" ], "github_reviewed": true, "github_reviewed_at": "2020-08-31T18:44:51Z", "nvd_published_at": null, "severity": "HIGH" }- References
Affected packages
npm / bleach
Package
- Name
- bleach
- View open source insights on deps.dev
- Purl
- pkg:npm/bleach