Description
Due to the common practice of providing vulnerability details in markdown format, the Dependency-Track frontend renders them using the JavaScript library Showdown. Showdown does not have any XSS countermeasures built in), and versions before 4.6.1 of the Dependency-Track frontend did not encode or sanitize Showdown’s output.
Recommendation
Update the @dependencytrack/frontend package to the latest compatible version. Followings are version details:
- Affected version(s): < 4.6.1
- Patched version(s): 4.6.1
References
Could your website be exposed too?
SmartScanner can check your website for @dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via Vulnerability Details and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via welcome message - CVE-2025-64758
- wangEditor was discovered to contain a cross-site scripting (XSS) vulnerability via the image upload function - CVE-2022-25037
- mxGraph vulnerable to cross-site scripting in setTooltips function - CVE-2022-40440
- @sveltejs/kit vulnerable to Cross-site Scripting via tracked search_params - CVE-2025-32388
You might also like:
See something that needs correcting? Let us knowUpdated January 30, 2023