layui vulnerable to cross-site scripting

Description

A vulnerability, which was classified as problematic, was found in layui up to v2.8.0-rc.16. This affects an unknown part of the component HTML Attribute Handler. The manipulation of the argument title leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 2.8.0 is able to address this issue.

Recommendation

Update the layui package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.8.0
• Patched version(s): 2.8.0

References

• GHSA-hx4h-676r-j3qp
• gitee.com
• vuldb.com
• CVE-2023-3691
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Layui cross-site scripting (XSS) vulnerability - CVE-2023-50550
• tarteaucitron.js vulnerable to Cross-site Scripting - CVE-2023-3620
• Jodit Editor vulnerable to cross-site scripting - CVE-2023-42399
• rsshub vulnerable to Cross-site Scripting via unvalidated URL parameters - CVE-2023-26491

Tags:

npm

layui