Cross-site Scripting in evershop - @evershop/evershop - GHSA-2xcj-557c-hf8r

Description

Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the sortBy parameter.

Recommendation

Update the @evershop/evershop package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.0.0-rc.8
• Patched version(s): 1.0.0-rc.8

References

• GHSA-2xcj-557c-hf8r
• devhub.checkmarx.com
• CVE-2023-46495
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Cross-site Scripting in evershop - CVE-2023-46499
• Cross Site Scripting in evershop - @evershop/evershop - CVE-2023-46494
• webmention.js Cross-site Scripting vulnerability - CVE-2023-3672
• Vega Expression Language `scale` expression function Cross Site Scripting - vega - CVE-2023-26486

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@evershop/evershop