Cross-site Scripting in tableexport.jquery.plugin

Description

There is a cross-site scripting vulnerability with default onCellHtmlData function in GitHub repository hhurz/tableexport.jquery.plugin prior to 1.25.0. This can result in transmitting cookies to third-party servers and/or sending data from secure sessions to third-party servers.

Recommendation

Update the tableexport.jquery.plugin package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.25.0
• Patched version(s): 1.25.0

References

• GHSA-j636-crp3-m584
• huntr.dev
• CVE-2022-1291
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Cross-site Scripting in jquery.json-viewer - CVE-2022-30241
• Cross-site Scripting in fullpage.js - CVE-2022-1330
• Cross-site Scripting in Auth0 Lock - CVE-2022-29172
• Cross-site Scripting in vditor (GHSA-pq37-4c4g-v38c) - CVE-2022-0341

Tags:

npm

tableexport.jquery.plugin