Cross-site scripting in jspdf

Description

It’s possible to use nested script tags in order to bypass the filtering regex.

Recommendation

Update the jspdf package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.0.0
• Patched version(s): 2.0.0

References

• GHSA-3q6f-8grx-pr4v
• snyk.io
• CVE-2020-7691
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Cross-site scripting in jspdf (GHSA-vh59-v9r5-4mh4) - CVE-2020-7690
• Cross-Site Scripting in Prism (GHSA-wvhm-4hhf-97x9) - CVE-2020-15138
• Cross-site Scripting in Joplin - CVE-2020-15930
• Cross-Site Scripting in jquery - CVE-2020-7656

Tags:

npm

jspdf