Cross-site Scripting in file-upload-with-preview

Description

This affects the package file-upload-with-preview before 4.2.0. A file containing malicious JavaScript code in the name can be uploaded (a user needs to be tricked into uploading such a file).

Recommendation

Update the file-upload-with-preview package to the latest compatible version. Followings are version details:

• Affected version(s): < 4.2.0
• Patched version(s): 4.2.0

References

• GHSA-97pv-4338-r5vp
• snyk.io
• CVE-2021-23439
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Parse Server vulnerable to stored cross-site scripting (XSS) via SVG file upload - CVE-2026-30948
• Cross-site Scripting (XSS) - Stored in crud-file-server - CVE-2018-3726
• Cross-site Scripting in video.js - CVE-2021-23414
• Cross-site scripting in react-bootstrap-table - CVE-2021-23398

Tags:

npm

file-upload-with-preview