bracket-template vulnerable to reflected XSS

Description

bracket-template suffers from reflected XSS possible when variable passed via GET parameter is used in template

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.1.5

References

• GHSA-488m-6gh8-9j36
• hackerone.com
• CVE-2018-3735
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Pandao editor.md vulnerable to XSS in IMG attributes - CVE-2018-16330
• Astro vulnerable to reflected XSS via the server islands feature - CVE-2025-64764
• MediaElement Vulnerable to Reflected XSS - CVE-2016-4567
• vue-template-compiler vulnerable to client-side Cross-Site Scripting (XSS) - CVE-2024-6783

Tags:

npm

bracket-template