Bootbox.js Cross Site Scripting vulnerability

Description

Cross Site Scripting vulnerability in BootBox Bootbox.js v.3.2 through 6.0 allows a remote attacker to execute arbitrary code via a crafted payload to alert(), confirm(), prompt() functions.

Recommendation

No fix is available yet. Followings are affected versions:

• >= 3.2.0, <= 6.0.0

References

• GHSA-m4ch-4m5f-2gp6
• CVE-2023-46998
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• @excalidraw/excalidraw Cross-site Scripting vulnerability - CVE-2023-26140
• Joplin Cross-site Scripting vulnerability - joplin - CVE-2023-37298
• Vega has Cross-site Scripting vulnerability in `lassoAppend` function - CVE-2023-26487
• Joplin Cross-site Scripting vulnerability - CVE-2023-37299

You might also like:

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Exploiting Server Version Disclosure

Tags:

npm

bootbox