Description
The @apollo/experimental-apollo-client-nextjs NPM package is vulnerable to a cross-site scripting vulnerability. This vulnerability arises from improper handling of untrusted input when @apollo/experimental-apollo-client-nextjs performs server-side rendering of HTML pages.
Recommendation
Update the @apollo/experimental-nextjs-app-support package to the latest compatible version. Followings are version details:
- Affected version(s): <= 0.6.0
- Patched version(s): 0.7.0
References
Could your website be exposed too?
SmartScanner can check your website for @apollo/experimental-nextjs-app-support Cross-site Scripting vulnerability and gives you actionable findings to investigate.
Start a free scanRelated Issues
- CKEditor4 Cross-site Scripting vulnerability caused by incorrect CDATA detection - CVE-2024-24815
- CKEditor4 low-risk cross-site scripting (XSS) vulnerability linked to potential domain takeover - CVE-2024-43411
- @urql/next Cross-site Scripting vulnerability - CVE-2024-24556
- TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements - CVE-2024-38357
You might also like:
See something that needs correcting? Let us knowUpdated January 30, 2024