Cross-Site Scripting Vulnerability in @joeattardi/emoji-button

Description

There are two vectors for XSS attacks with versions of @joeattardi/emoji-button before 4.6.2:

• A URL for a custom emoji
• An i18n string

In both of these cases, a value can be crafted such that it can insert a script tag into the page and execute malicious code.

Recommendation

Update the @joeattardi/emoji-button package to the latest compatible version. Followings are version details:

• Affected version(s): < 4.6.2
• Patched version(s): 4.6.2

References

• GHSA-f34m-x9pj-62vq
• CVE-2021-43785
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• iziModal Cross-site Scripting vulnerability - CVE-2021-32860
• Margox Braft-Editor Cross-site Scripting Vulnerability - CVE-2021-27524
• textAngular Cross-site Scripting vulnerability - CVE-2021-32854
• Mind-elixir Cross-site Scripting vulnerability - CVE-2021-32851

You might also like:

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Exploiting Server Version Disclosure

Tags:

npm

@joeattardi/emoji-button