Cross-Site Scripting in semantic-ui-search

Description

All versions of semantic-ui-search are vulnerable to Cross-Site Scripting. Lack of output encoding on the selection dropdowns can lead to user input being executed instead of printed as text.

Recommendation

No fix is available yet. Followings are affected versions:

• >= 0

References

• GHSA-p9vv-3945-x93h
• www.npmjs.com
• CWE-79
• OWASP 2021-A3

Related Issues

• Cross-site Scripting in @spscommerce/ds-react - Vulnerability
• RSSHub Cross-site Scripting vulnerability caused by internal media proxy - CVE-2024-27926
• TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements - CVE-2024-29881
• TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes - CVE-2024-29203

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

semantic-ui-search