Improper Neutralization of Script in Attributes in @dcl/single-sign-on-client

Description

Improper input validation in the init function allows arbitrary javascript to be executed using the javascript: prefix

Recommendation

Update the @dcl/single-sign-on-client package to the latest compatible version. Followings are version details:

Affected version(s): < 0.1.0
Patched version(s): 0.1.0

References

GHSA-vp4f-wxgw-7x8x
CVE-2023-41049
CWE-79
CAPEC-310
OWASP 2021-A3
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for Improper Neutralization of Script in Attributes in @dcl/single-sign-on-client and gives you actionable findings to investigate.

Start a free scan

Related Issues

browserify-sign upper bound check issue in `dsaVerify` leads to a signature forgery attack - CVE-2023-46234
Improper Neutralization of Input During Web Page Generation in Select2 - CVE-2016-10744
Strapi Improper Rate Limiting vulnerability - @strapi/plugin-users-permissions - CVE-2023-38507
Strapi Improper Rate Limiting vulnerability - CVE-2023-38507

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

See something that needs correcting? Let us knowUpdated November 05, 2023