DOM clobbering could escalate to Cross-site Scripting (XSS) - @pagefind/default-ui

Description

Pagefind initializes its dynamic JavaScript and WebAssembly files relative to the location of the first script you load. This information is gathered by looking up the value of document.currentScript.src.

Recommendation

Update the @pagefind/default-ui package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.1.1
• Patched version(s): 1.1.1

References

• GHSA-gprj-6m2f-j9hx
• CVE-2024-45389
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• DOM clobbering could escalate to Cross-site Scripting (XSS) - pagefind - CVE-2024-45389
• DOM clobbering could escalate to Cross-site Scripting (XSS) - CVE-2024-45389
• Layui has DOM Clobbering gadgets that leads to Cross-site Scripting - CVE-2024-47075
• TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes - CVE-2024-29203

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Tags:

npm

@pagefind/default-ui