Cross-Site Scripting in bootbox

Description

All version of bootbox are vulnerable to Cross-Site Scripting. The package does not sanitize user input in the provided dialog boxes, allowing attackers to inject HTML code and execute arbitrary JavaScript.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 5.5.2

References

• GHSA-87mg-h5r3-hw88
• hackerone.com
• www.npmjs.com
• CWE-64
• CWE-79
• OWASP 2021-A3

Related Issues

• Bootbox.js Cross Site Scripting vulnerability - CVE-2023-46998
• RSSHub Cross-site Scripting vulnerability caused by internal media proxy - CVE-2024-27926
• TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements - CVE-2024-29881
• TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes - CVE-2024-29203

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

bootbox