Description
Versions of jingo prior to 1.9.2 are vulnerable to Cross-Site Scripting (XSS). If malicious input such as <script>alert(1)</script> is placed in the content of a wiki page, Jingo does not properly encode the input and it is executed instead of rendered as text.
Recommendation
Update the jingo package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.9.2
- Patched version(s): 1.9.2
References
Related Issues
- Prototype Pollution in lodash - CVE-2018-3721
- Cross-site Scripting in quill - CVE-2021-3163
- Prototype Pollution in async - CVE-2021-43138
- Joplin Remote Code Execution - CVE-2022-40277
- Tags:
- npm
- jingo
Anything's wrong? Let us know Last updated on January 09, 2023