Description
Affected versions of gmail-js are vulnerable to cross-site scripting in the tools.parse_response, helper.get.visible_emails_post, and helper.get.email_data_post functions, which pass user input directly into the Function constructor.
Recommendation
Update the gmail-js package to the latest compatible version. Followings are version details:
- Affected version(s): <= 0.6.4
- Patched version(s): 0.6.5
References
Could your website be exposed too?
SmartScanner can check your website for DOM-based XSS in gmail-js and gives you actionable findings to investigate.
Start a free scanRelated Issues
- CleverTap Web SDK is vulnerable to DOM-based XSS via handleCustomHtmlPreviewPostMessageEvent function - CVE-2026-26861
- CleverTap Web SDK is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage - CVE-2026-26862
- DOM-based XSS in auth0-lock - CVE-2020-15119
- vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes - @intlify/core-base - CVE-2025-53892
You might also like:
See something that needs correcting? Let us knowUpdated January 09, 2023