Cross-site scripting in Survey Creator

Description

Cross Site Scripting (XSS) vulnerability in SurveyJS Survey Creator v.1.9.132 and before, allows attackers to execute arbitrary code and obtain sensitive information via the title parameter in form.

Recommendation

Update the survey-creator package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.9.133
• Patched version(s): 1.9.133

References

• GHSA-xgj4-2hrf-j4xg
• packetstormsecurity.com
• CVE-2024-28635
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• pg-promise SQL Injection vulnerability - CVE-2025-29744
• njwt Prototype Pollution vulnerability - CVE-2024-34273
• Elliptic allows BER-encoded signatures - CVE-2024-42461
• ejs lacks certain pollution protection - CVE-2024-33883

Tags:

npm

survey-creator