Description
Versions of jingo prior to 1.9.2 are vulnerable to Cross-Site Scripting (XSS). If malicious input such as <script>alert(1)</script> is placed in the content of a wiki page, Jingo does not properly encode the input and it is executed instead of rendered as text.
Recommendation
Update the jingo package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.9.2
- Patched version(s): 1.9.2
References
Related Issues
- Cross-Site Scripting in buefy - Vulnerability
- html2pdf.js contains a cross-site scripting vulnerability - CVE-2026-22787
- CKEditor 5 cross-site scripting (XSS) vulnerability in the clipboard package - CVE-2025-58064
- QMarkdown Cross-Site Scripting (XSS) vulnerability - CVE-2025-43954
You might also like:
- Tags:
- npm
- jingo
Anything's wrong? Let us know Last updated on January 09, 2023