Cross-Site Scripting in status-board

Description

All versions of status-board are vulnerable to Cross-Site Scripting. The renderJsDashboard() function concatenates the safeDashboard variable to the HTTP response message with insufficient sanitization. If this variable is controlled by user input it may allow attackers to execute arbitrary JavaScript in a victim’s browser.

Recommendation

Update the status-board package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.1.82
• Patched version(s): 1.1.82

References

• GHSA-6m4r-cgm3-6q7q
• snyk.io
• www.npmjs.com
• CVE-2019-15478
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• PrismJS DOM Clobbering vulnerability - CVE-2024-53382
• Server-Side Request Forgery in axios - CVE-2024-39338
• DOS by abusing `fetchOptions.retry`. - CVE-2023-49800
• Prototype Pollution in querystringify - Vulnerability

Tags:

npm

status-board