Cross-site scripting in jspdf

Description

It’s possible to use nested script tags in order to bypass the filtering regex.

Recommendation

Update the jspdf package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.0.0
• Patched version(s): 2.0.0

References

• GHSA-3q6f-8grx-pr4v
• snyk.io
• CVE-2020-7691
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Cross-site scripting in jspdf (GHSA-vh59-v9r5-4mh4) - CVE-2020-7690
• Cross-site Scripting in dompurify (GHSA-63q7-h895-m982) - CVE-2020-26870
• Cross-site Scripting in vis-timeline - CVE-2020-28487
• Cross-site Scripting (XSS) in Eclipse Theia - CVE-2020-27224

Tags:

npm

jspdf