GHSA-gjh4-fcv3-whpq

Suggest an improvement
Source
https://github.com/advisories/GHSA-gjh4-fcv3-whpq
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/09/GHSA-gjh4-fcv3-whpq/GHSA-gjh4-fcv3-whpq.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-gjh4-fcv3-whpq
Aliases
Published
2019-09-04T10:02:50Z
Modified
2023-11-08T04:01:15Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Cross-Site Scripting in webtorrent
Details

Versions of webtorrent prior to 0.107.6 are vulnerable to Cross-Site Scripting. webtorrent servers started with torrent.createServer() lists a torrent's title and files in the index page without sanitization. This allows attackers to execute arbitrary JavaScript in the victim's browser through files with names containing the malicious payload. The issue is mitigated due to the fact that the server only allows fetching data pieces from the torrent.

Recommendation

Upgrade to version 0.107.6 or later.

Database specific 
{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2019-09-03T09:58:03Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}
References

Affected packages

npm / webtorrent

Package

Name
webtorrent
View open source insights on deps.dev
Purl
pkg:npm/webtorrent

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.107.6

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/09/GHSA-gjh4-fcv3-whpq/GHSA-gjh4-fcv3-whpq.json"