GHSA-87mg-h5r3-hw88

Source

https://github.com/advisories/GHSA-87mg-h5r3-hw88

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/05/GHSA-87mg-h5r3-hw88/GHSA-87mg-h5r3-hw88.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-87mg-h5r3-hw88

Published

2019-05-30T17:23:28Z

Modified

2021-09-16T21:01:13Z

Summary

Cross-Site Scripting in bootbox

Details

All version of bootbox are vulnerable to Cross-Site Scripting. The package does not sanitize user input in the provided dialog boxes, allowing attackers to inject HTML code and execute arbitrary JavaScript.

Recommendation

Sanitize user input being passed to bootbox or consider using an alternative package.

Database specific

{
    "cwe_ids":  [
        "CWE-64",
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2019-05-30T17:22:56Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

Affected packages

npm / bootbox

Package

Name: bootbox; View open source insights on deps.dev
Purl: pkg:npm/bootbox

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

5.5.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/05/GHSA-87mg-h5r3-hw88/GHSA-87mg-h5r3-hw88.json"