GHSA-h9wr-xr4r-66fh

Source

https://github.com/advisories/GHSA-h9wr-xr4r-66fh

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-h9wr-xr4r-66fh/GHSA-h9wr-xr4r-66fh.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-h9wr-xr4r-66fh

Published

2020-09-03T18:20:20Z

Modified

2020-08-31T18:46:37Z

Summary

Cross-Site Scripting in dmn-js-properties-panel

Details

Versions of dmn-js-properties-panel prior to 0.8.0 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize input in specially configured diagrams, which may allow attackers to inject arbitrary JavaScript in the embedding website.

Recommendation

Upgrade to version 0.3.0 or later.

Database specific

{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-08-31T18:46:37Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}

References

https://www.npmjs.com/advisories/1081

Affected packages

npm / dmn-js-properties-panel

Package

Name: dmn-js-properties-panel; View open source insights on deps.dev
Purl: pkg:npm/dmn-js-properties-panel

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.3.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-h9wr-xr4r-66fh/GHSA-h9wr-xr4r-66fh.json"