Cross-site Scripting in file-upload-with-preview

Description

This affects the package file-upload-with-preview before 4.2.0. A file containing malicious JavaScript code in the name can be uploaded (a user needs to be tricked into uploading such a file).

Recommendation

Update the file-upload-with-preview package to the latest compatible version. Followings are version details:

• Affected version(s): < 4.2.0
• Patched version(s): 4.2.0

References

• GHSA-97pv-4338-r5vp
• snyk.io
• CVE-2021-23439
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Parse Server vulnerable to stored cross-site scripting (XSS) via SVG file upload - CVE-2026-30948
• vditor Vulnerable to Cross-site Scripting in SVG events - CVE-2021-4103
• Cross-site Scripting in vmd - CVE-2021-33041
• Cross-site scripting in react-bootstrap-table - CVE-2021-23398

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

file-upload-with-preview