bracket-template vulnerable to reflected XSS

Description

bracket-template suffers from reflected XSS possible when variable passed via GET parameter is used in template

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.1.5

References

• GHSA-488m-6gh8-9j36
• hackerone.com
• CVE-2018-3735
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• ReDoS Vulnerability in ua-parser-js version - CVE-2022-25927
• node-cube vulnerable to prototype pollution - CVE-2025-57348
• DOMPurify allows Cross-site Scripting (XSS) - CVE-2025-26791
• lite-server vulnerable to Denial of Service - CVE-2022-25940

Tags:

npm

bracket-template