Cross-Site Scripting in atlasboard-atlassian-package

Description

All versions of atlasboard-atlassian-package prior to 0.4.2 are vulnerable to Cross-Site Scripting (XSS). The package fails to properly sanitize user input that is rendered as HTML, which may allow attackers to execute arbitrary JavaScript in a victim’s browser. This requires attackers being able to change issue summaries in Jira tickets.

Recommendation

No fix is available yet. Followings are affected versions:

• >= 0.0.0

References

• GHSA-25v4-mcx4-hh35
• hackerone.com
• www.npmjs.com
• CWE-79
• OWASP 2021-A3

Related Issues

• CKEditor 5 cross-site scripting (XSS) vulnerability in the clipboard package - ckeditor5 - CVE-2025-58064
• CKEditor 5 cross-site scripting (XSS) vulnerability in the clipboard package - CVE-2025-58064
• Bootstrap Cross-site Scripting vulnerability - bootstrap - GHSA-7mvr-5x2g-wfc8 - CVE-2018-14042
• Cross-Site Scripting in @progress/kendo-angular-editor - Vulnerability

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

atlasboard-atlassian-package