Cross-site Scripting in tableexport.jquery.plugin

Description

There is a cross-site scripting vulnerability with default onCellHtmlData function in GitHub repository hhurz/tableexport.jquery.plugin prior to 1.25.0. This can result in transmitting cookies to third-party servers and/or sending data from secure sessions to third-party servers.

Recommendation

Update the tableexport.jquery.plugin package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.25.0
• Patched version(s): 1.25.0

References

• GHSA-j636-crp3-m584
• huntr.dev
• CVE-2022-1291
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Cross-site Scripting in jquery.json-viewer - CVE-2022-30241
• jQuery-UI vulnerable to Cross-site Scripting in dialog closeText - CVE-2016-7103
• Cross-Site Scripting (XSS) in jquery - CVE-2015-9251
• jplayer Cross Site Scripting vulnerability - CVE-2013-2022

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

tableexport.jquery.plugin