GHSA-xwqw-rf2q-xmhf

Source

https://github.com/advisories/GHSA-xwqw-rf2q-xmhf

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-xwqw-rf2q-xmhf/GHSA-xwqw-rf2q-xmhf.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-xwqw-rf2q-xmhf

Published

2020-09-01T21:23:38Z

Modified

2021-09-24T22:00:38Z

Summary

Cross-Site Scripting in buefy

Details

Versions of buefy prior to 0.7.2 are vulnerable to Cross-Site Scripting, allowing attackers to manipulate the DOM and execute remote code. The autocomplete list renders user input as HTML without encoding.

Recommendation

Upgrade to version 0.7.2 or later.

Database specific

{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-08-31T18:34:21Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}

References

Affected packages

npm / buefy

Package

Name: buefy; View open source insights on deps.dev
Purl: pkg:npm/buefy

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.7.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-xwqw-rf2q-xmhf/GHSA-xwqw-rf2q-xmhf.json"