Cross-Site Scripting in @ionic/core

Description

Versions of @ionic/core prior to 4.0.3, 4.1.3, 4.2.1 or 4.3.1 are vulnerable to Cross-Site Scripting (XSS). The package uses the unsafe innerHTML function without sanitizing input, which may allow attackers to execute arbitrary JavaScript on the victim’s browser. This issue affects the components:

• <ion-alert>.message
• <ion-searchbar>.placeholder
• <ion-infinite-scroll-content>.loadingText
• <ion-refresher-content>.pullingText
• `.

Recommendation

Update the @ionic/core package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 4.3.0, < 4.3.1

  >= 4.2.0, < 4.2.1

  >= 4.1.0, < 4.1.3

  < 4.0.3**

• Patched version(s): **4.3.1

  4.2.1

  4.1.3

  4.0.3**

References

• GHSA-r3xc-47qg-h929
• www.npmjs.com
• CWE-79
• OWASP 2021-A3