jquery.terminal self XSS on user input

Description

This is low impact and limited XSS, because code for XSS payload is always visible, but attacker can use other techniques to hide the code the victim sees.

Also if the application use execHash option and execute code from URL the attacker can use this URL to execute his code.

Recommendation

Update the jquery.terminal package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.31.1
• Patched version(s): 2.31.1

References

• GHSA-x9r5-jxvq-4387
• CVE-2021-43862
• CWE-79
• CWE-80
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• materialize-css vulnerable to cross-site Scripting (XSS) due to improper escape of user input - CVE-2022-25349
• XSS in the `altField` option of the Datepicker widget in jquery-ui - CVE-2021-41182
• XSS in `*Text` options of the Datepicker widget in jquery-ui - CVE-2021-41183
• XSS in the `of` option of the `.position()` util in jquery-ui - CVE-2021-41184

Tags:

npm

jquery.terminal