Cross-site Scripting in file-upload-with-preview

Description

This affects the package file-upload-with-preview before 4.2.0. A file containing malicious JavaScript code in the name can be uploaded (a user needs to be tricked into uploading such a file).

Recommendation

Update the file-upload-with-preview package to the latest compatible version. Followings are version details:

• Affected version(s): < 4.2.0
• Patched version(s): 4.2.0

References

• GHSA-97pv-4338-r5vp
• snyk.io
• CVE-2021-23439
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Cross-site scripting in react-bootstrap-table - CVE-2021-23398
• iziModal Cross-site Scripting vulnerability - CVE-2021-32860
• Baremetrics date range picker vulnerable to Cross-site Scripting - CVE-2021-32859
• Strapi 4.1.12 Cross-site Scripting via crafted file - CVE-2022-32114

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

file-upload-with-preview