fuelux vulnerable to Cross-Site Scripting in Pillbox feature

Description

Affected versions of fuelux contain a cross-site scripting vulnerability in the Pillbox feature. By supplying a script as a value for a new pillbox, it is possible to cause arbitrary script execution.

Recommendation

Update the fuelux package to the latest compatible version. Followings are version details:

• Affected version(s): < 3.15.7
• Patched version(s): 3.15.7

References

• GHSA-fwcw-5qw2-87mp
• www.npmjs.com
• CVE-2016-1000235
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• jQuery-UI vulnerable to Cross-site Scripting in dialog closeText - CVE-2016-7103
• Bootstrap Cross-site Scripting vulnerability - CVE-2016-10735
• Cross-Site Scripting in swagger-ui - swagger-ui - CVE-2016-1000233
• Trix vulnerable to Cross-site Scripting on copy & paste - CVE-2025-46812

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

fuelux