GHSA-c53x-wwx2-pg96

Suggest an improvement
Source
https://github.com/advisories/GHSA-c53x-wwx2-pg96
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-c53x-wwx2-pg96/GHSA-c53x-wwx2-pg96.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-c53x-wwx2-pg96
Published
2020-09-03T17:03:58Z
Modified
2021-09-28T17:27:43Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Cross-Site Scripting in @berslucas/liljs
Details

Versions of @berslucas/liljs prior to 1.0.2 are vulnerable to Cross-Site Scripting (XSS). The package uses the unsafe innerHTML function without sanitizing input, which may allow attackers to execute arbitrary JavaScript on the victim's browser.

Recommendation

Upgrade to version 1.0.2 or later.

Database specific 
{
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:44:14Z",
    "nvd_published_at": null,
    "severity": "MODERATE",
    "cwe_ids": [
        "CWE-79"
    ]
}
References

Affected packages

npm / @berslucas/liljs

Package

Name
@berslucas/liljs
View open source insights on deps.dev
Purl
pkg:npm/%40berslucas/liljs

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.0.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-c53x-wwx2-pg96/GHSA-c53x-wwx2-pg96.json"