Cross-Site Scripting in bootbox

Description

All version of bootbox are vulnerable to Cross-Site Scripting. The package does not sanitize user input in the provided dialog boxes, allowing attackers to inject HTML code and execute arbitrary JavaScript.

Recommendation

No fix is available yet. Followings are affected versions:

<= 5.5.2

References

GHSA-87mg-h5r3-hw88
hackerone.com
www.npmjs.com
CWE-64
CWE-79
OWASP 2021-A3

Could your website be exposed too?

SmartScanner can check your website for Cross-Site Scripting in bootbox and gives you actionable findings to investigate.

Start a free scan

Related Issues

Bootbox.js Cross Site Scripting vulnerability - CVE-2023-46998
RSSHub Cross-site Scripting vulnerability caused by internal media proxy - CVE-2024-27926
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements - CVE-2024-29881
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes - CVE-2024-29203

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

See something that needs correcting? Let us knowUpdated January 09, 2023