fuelux vulnerable to Cross-Site Scripting in Pillbox feature

Description

Affected versions of fuelux contain a cross-site scripting vulnerability in the Pillbox feature. By supplying a script as a value for a new pillbox, it is possible to cause arbitrary script execution.

Recommendation

Update the fuelux package to the latest compatible version. Followings are version details:

• Affected version(s): < 3.15.7
• Patched version(s): 3.15.7

References

• GHSA-fwcw-5qw2-87mp
• www.npmjs.com
• CVE-2016-1000235
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• jQuery-UI vulnerable to Cross-site Scripting in dialog closeText - CVE-2016-7103
• Bootstrap Cross-site Scripting vulnerability - CVE-2016-10735
• Bootstrap Cross-site Scripting vulnerability (GHSA-4p24-vmcr-4gqj) - CVE-2016-10735
• Bootstrap Vulnerable to Cross-Site Scripting - CVE-2019-8331

Tags:

npm

fuelux