Cross-Site Scripting in bracket-template

Description

All versions of bracket-template are vulnerable to stored cross-site scripting (XSS). This is exploitable when a variable passed in via a GET parameter is used in a template.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.1.5

References

• GHSA-jj6g-7j8p-7gf2
• hackerone.com
• www.npmjs.com
• CWE-79
• OWASP 2021-A3

Related Issues

• Cross-Site Scripting in react-marked-markdown - Vulnerability
• CKEditor4 Cross-site Scripting vulnerability in samples with enabled the preview feature - CVE-2024-24816
• Stimulsoft Dashboard.JS Cross Site Scripting vulnerability - stimulsoft-dashboards-js - CVE-2024-24397
• CKEditor4 Cross-site Scripting vulnerability caused by incorrect CDATA detection - CVE-2024-24815

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

bracket-template