Cross-site Scripting in @spscommerce/ds-react

Description

XSS, anyone using the SPS Select with options prop populated from user input is impacted. If these options are stored, then it could have been a stored XSS.

Recommendation

Update the @spscommerce/ds-react package to the latest compatible version. Followings are version details:

• Affected version(s): >= 4.12.2, < 7.17.4
• Patched version(s): 7.17.4

References

• GHSA-cfxh-frx4-9gjg
• CWE-79
• OWASP 2021-A3

Related Issues

• Cross-Site Scripting in react-marked-markdown - Vulnerability
• Cross-Site Scripting in react - Vulnerability
• Cross-Site Scripting in react-svg - Vulnerability
• react-query-streamed-hydration Cross-site Scripting vulnerability - CVE-2024-24558

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@spscommerce/ds-react