GHSA-w4v7-hwx7-9929

Source

https://github.com/advisories/GHSA-w4v7-hwx7-9929

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/11/GHSA-w4v7-hwx7-9929/GHSA-w4v7-hwx7-9929.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-w4v7-hwx7-9929

Aliases

CVE-2021-23784
SNYK-JS-TEMPURA-1569633

Published

2021-11-08T17:50:10Z

Modified

2026-07-08T06:50:00Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Cross-site Scripting in tempura

Details

This affects the package tempura before 0.4.0. If the input to the esc function is of type object (i.e an array) it is returned without being escaped/sanitized, leading to a potential Cross-Site Scripting vulnerability.

Database specific

{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2021-11-04T16:59:09Z",
    "nvd_published_at":  "2021-11-03T18:15:00Z",
    "severity":  "MODERATE"
}

References

Affected packages

npm / tempura

Package

Name: tempura; View open source insights on deps.dev
Purl: pkg:npm/tempura

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.4.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/11/GHSA-w4v7-hwx7-9929/GHSA-w4v7-hwx7-9929.json"