@apollo/experimental-nextjs-app-support Cross-site Scripting vulnerability

Description

The @apollo/experimental-apollo-client-nextjs NPM package is vulnerable to a cross-site scripting vulnerability. This vulnerability arises from improper handling of untrusted input when @apollo/experimental-apollo-client-nextjs performs server-side rendering of HTML pages.

Recommendation

Update the @apollo/experimental-nextjs-app-support package to the latest compatible version. Followings are version details:

• Affected version(s): <= 0.6.0
• Patched version(s): 0.7.0

References

• GHSA-rv8p-rr2h-fgpg
• CVE-2024-23841
• CWE-80
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• CKEditor4 Cross-site Scripting vulnerability caused by incorrect CDATA detection - CVE-2024-24815
• CKEditor4 low-risk cross-site scripting (XSS) vulnerability linked to potential domain takeover - CVE-2024-43411
• @urql/next Cross-site Scripting vulnerability - CVE-2024-24556
• TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements - CVE-2024-38357

You might also like:

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Exploiting Server Version Disclosure

Tags:

npm

@apollo/experimental-nextjs-app-support