GHSA-cfxh-frx4-9gjg

Source

https://github.com/advisories/GHSA-cfxh-frx4-9gjg

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/12/GHSA-cfxh-frx4-9gjg/GHSA-cfxh-frx4-9gjg.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-cfxh-frx4-9gjg

Published

2023-12-15T03:13:18Z

Modified

2023-12-15T03:13:18Z

Summary

Cross-site Scripting in @spscommerce/ds-react

Details

Impact

XSS, anyone using the SPS Select with options prop populated from user input is impacted. If these options are stored, then it could have been a stored XSS.

Patches

The code has been patched for version 7 of woodland. Users should upgrade to 7.17.4 or higher

Workarounds

This is not recommended. If you are not upgrading then you would need to sanitize your options yourself (including those currently stored in databases). This is not recommended.

References

https://github.com/SPSCommerce/woodland/blob/c49e999f97f3c0b56502859f4de1e8c6666dd74d/packages/ds-react/src/option-list/SpsOptionList.tsx#L559

Database specific

{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2023-12-15T03:13:18Z",
    "nvd_published_at":  null,
    "severity":  "CRITICAL"
}

References

Affected packages

npm / @spscommerce/ds-react

Package

Name: @spscommerce/ds-react; View open source insights on deps.dev
Purl: pkg:npm/%40spscommerce/ds-react

Affected ranges

Type: SEMVER
Events: Introduced

4.12.2

Fixed

7.17.4

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/12/GHSA-cfxh-frx4-9gjg/GHSA-cfxh-frx4-9gjg.json"