DOM-based XSS in auth0-lock

Description

Versions before and including 11.25.1 are using dangerouslySetInnerHTML to display an informational message when used with a Passwordless or Enterprise connection.

• For Passwordless connection, the value of the input (email or phone number) is displayed back to the user while waiting for verification code input.

Recommendation

Update the auth0-lock package to the latest compatible version. Followings are version details:

• Affected version(s): <= 11.25.1
• Patched version(s): 11.26.3

References

• GHSA-6gg3-pmm7-97xc
• CVE-2020-15119
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Denial of Service in jquery - CVE-2016-10707
• gifplayer XSS vulnerability - CVE-2025-31128
• Prototype pollution in gsap - CVE-2020-28478
• pym.js CSRF Vulnerability - CVE-2018-1000086

Tags:

npm

auth0-lock