GHSA-r32x-jhw5-g48p

Suggest an improvement
Source
https://github.com/advisories/GHSA-r32x-jhw5-g48p
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-r32x-jhw5-g48p/GHSA-r32x-jhw5-g48p.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-r32x-jhw5-g48p
Published
2020-09-03T17:08:20Z
Modified
2021-09-28T21:17:47Z
Summary
Cross-Site Scripting in eco
Details

All versions of eco are vulnerable to Cross-Site Scripting (XSS). The package's default __escape implementation fails to escape single quotes, which may allow attackers to execute arbitrary JavaScript on the victim's browser.

Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Database specific 
{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-08-31T18:44:34Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}
References

Affected packages

npm / eco

Package

Name
eco
View open source insights on deps.dev
Purl
pkg:npm/eco

Affected ranges

Type
SEMVER
Events
Introduced
0.0.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-r32x-jhw5-g48p/GHSA-r32x-jhw5-g48p.json"