grapesjs before 0.19.5 vulnerable to Cross-site Scripting

Description

The package grapesjs before 0.19.5 is vulnerable to Cross-site Scripting (XSS) due to an improper sanitization of the class name in Selector Manager.

Recommendation

No fix is available yet. Followings are affected versions:

• < 0.19.5

References

• GHSA-589f-c66p-hxr4
• security.snyk.io
• CVE-2022-21802
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• metascraper before v5.2.0 vulnerable to stored cross-site scripting - CVE-2018-3773
• node-red-dashboard vulnerable to Cross-site Scripting - CVE-2022-3783
• @dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via Vulnerability Details - CVE-2022-39350
• mxGraph vulnerable to cross-site scripting in setTooltips function - CVE-2022-40440

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

grapesjs