Cross-Site Scripting in nextcloud-vue-collections

Description

Versions of nextcloud-vue-collections prior to 0.4.2 are vulnerable to Cross-Site Scripting (XSS). The v-tooltip component has an insecure defaultHTML configuration that allows arbitrary JavaScript to be injected in the tooltip of a collection item. This allows attackers to execute arbitrary code in a victim’s browser.

Recommendation

Update the nextcloud-vue-collections package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.4.2
• Patched version(s): 0.4.2

References

• GHSA-whv6-rj84-2vh2
• www.npmjs.com
• CWE-79
• OWASP 2021-A3

Related Issues

• vue-i18n has cross-site scripting vulnerability with prototype pollution - CVE-2024-52809
• vue-i18n has cross-site scripting vulnerability with prototype pollution - vue-i18n - CVE-2024-52809
• vue-i18n has cross-site scripting vulnerability with prototype pollution - @intlify/vue-i18n-core - CVE-2024-52809
• vue-i18n has cross-site scripting vulnerability with prototype pollution - @intlify/core - CVE-2024-52809

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

nextcloud-vue-collections