Cross-Site Scripting in bootstrap-tagsinput

Description

All versions of bootstrap-tagsinput are vulnerable to cross-site scripting when user input is passed into the itemTitle parameter unmodified, as the package fails to properly sanitize or encode user input for that parameter.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 0.8.0

References

• GHSA-v2jq-9475-r5g8
• www.npmjs.com
• CVE-2016-1000227
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Bootstrap Cross-site Scripting vulnerability - CVE-2016-10735
• Bootstrap Cross-site Scripting vulnerability - bootstrap - GHSA-4p24-vmcr-4gqj - CVE-2016-10735
• Cross-Site Scripting in jqtree - CVE-2016-1000234
• Cross-Site Scripting in swagger-ui - swagger-ui - CVE-2016-1000233

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

bootstrap-tagsinput