Description
A vulnerability, which was classified as problematic, was found in layui up to v2.8.0-rc.16. This affects an unknown part of the component HTML Attribute Handler. The manipulation of the argument title leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 2.8.0 is able to address this issue.
Recommendation
Update the layui package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.8.0
- Patched version(s): 2.8.0
References
Could your website be exposed too?
SmartScanner can check your website for layui vulnerable to cross-site scripting and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Layui cross-site scripting (XSS) vulnerability - CVE-2023-50550
- TinyMCE vulnerable to mutation Cross-site Scripting via special characters in unescaped text nodes - CVE-2023-48219
- Jodit Editor vulnerable to cross-site scripting - CVE-2023-42399
- @mattkrick/sanitize-svg vulnerable to Cross-Site Scripting (XSS) - CVE-2023-22461
You might also like:
See something that needs correcting? Let us knowUpdated November 05, 2023