Cross-Site Scripting in bracket-template

Description

All versions of bracket-template are vulnerable to stored cross-site scripting (XSS). This is exploitable when a variable passed in via a GET parameter is used in a template.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.1.5

References

• GHSA-jj6g-7j8p-7gf2
• hackerone.com
• www.npmjs.com
• CWE-79
• OWASP 2021-A3

Related Issues

• tarteaucitron Cross-site Scripting (XSS) - CVE-2025-1467
• Cross site scripting in markdown-to-jsx - CVE-2024-21535
• uPlot Prototype Pollution vulnerability - CVE-2024-21489
• FUXA local file inclusion vulnerability - CVE-2023-31718

Tags:

npm

bracket-template