Description
All versions of eco are vulnerable to Cross-Site Scripting (XSS). The package’s default __escape implementation fails to escape single quotes, which may allow attackers to execute arbitrary JavaScript on the victim’s browser.
Recommendation
No fix is available yet. Followings are affected versions:
- >= 0.0.0
References
Related Issues
- Prototype pollution in 101 - CVE-2021-25943
- Use-After-Free in puppeteer - CVE-2019-5786
- Open Redirect in node-forge - CVE-2022-0122
- Denial of service in three - CVE-2020-28496
- Tags:
- npm
- eco
Anything's wrong? Let us know Last updated on January 09, 2023