Cross-Site Scripting in jingo

Description

Versions of jingo prior to 1.9.2 are vulnerable to Cross-Site Scripting (XSS). If malicious input such as <script>alert(1)</script> is placed in the content of a wiki page, Jingo does not properly encode the input and it is executed instead of rendered as text.

Recommendation

Update the jingo package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.9.2
• Patched version(s): 1.9.2

References

• GHSA-mpjf-8cmf-p789
• www.npmjs.com
• CWE-79
• OWASP 2021-A3

Related Issues

• @urql/next Cross-site Scripting vulnerability - CVE-2024-24556
• vue-i18n has cross-site scripting vulnerability with prototype pollution - CVE-2024-52809
• seajs Cross-site Scripting vulnerability - CVE-2024-51091
• vue-i18n has cross-site scripting vulnerability with prototype pollution (GHSA-9r9m-ffp6-9x4v) - CVE-2024-52809

Tags:

npm

jingo