Description
This affects the package file-upload-with-preview before 4.2.0. A file containing malicious JavaScript code in the name can be uploaded (a user needs to be tricked into uploading such a file).
Recommendation
Update the file-upload-with-preview package to the latest compatible version. Followings are version details:
- Affected version(s): < 4.2.0
- Patched version(s): 4.2.0
References
Could your website be exposed too?
SmartScanner can check your website for Cross-site Scripting in file-upload-with-preview and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Cross-site scripting in react-bootstrap-table - CVE-2021-23398
- iziModal Cross-site Scripting vulnerability - CVE-2021-32860
- Baremetrics date range picker vulnerable to Cross-site Scripting - CVE-2021-32859
- Strapi 4.1.12 Cross-site Scripting via crafted file - CVE-2022-32114
You might also like:
See something that needs correcting? Let us knowUpdated February 01, 2023