Cross-Site Scripting in jingo

Description

Versions of jingo prior to 1.9.2 are vulnerable to Cross-Site Scripting (XSS). If malicious input such as <script>alert(1)</script> is placed in the content of a wiki page, Jingo does not properly encode the input and it is executed instead of rendered as text.

Recommendation

Update the jingo package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.9.2
• Patched version(s): 1.9.2

References

• GHSA-mpjf-8cmf-p789
• www.npmjs.com
• CWE-79
• OWASP 2021-A3

Related Issues

• RSSHub Cross-site Scripting vulnerability caused by internal media proxy - CVE-2024-27926
• Vulnogram contains a stored cross-site scripting vulnerability in comment hypertext handling - CVE-2026-32774
• Cross-Site Scripting in highcharts - Vulnerability
• Joplin Cross-site Scripting vulnerability - CVE-2023-37299

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

jingo