DOM-based XSS in gmail-js

Description

Affected versions of gmail-js are vulnerable to cross-site scripting in the tools.parse_response, helper.get.visible_emails_post, and helper.get.email_data_post functions, which pass user input directly into the Function constructor.

Recommendation

Update the gmail-js package to the latest compatible version. Followings are version details:

• Affected version(s): <= 0.6.4
• Patched version(s): 0.6.5

References

• GHSA-c7pp-g2v2-2766
• www.npmjs.com
• CVE-2016-1000228
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Denial of Service in jquery - CVE-2016-10707
• gifplayer XSS vulnerability - CVE-2025-31128
• Prototype pollution in gsap - CVE-2020-28478
• pym.js CSRF Vulnerability - CVE-2018-1000086

Tags:

npm

gmail-js