layui vulnerable to cross-site scripting

Description

A vulnerability, which was classified as problematic, was found in layui up to v2.8.0-rc.16. This affects an unknown part of the component HTML Attribute Handler. The manipulation of the argument title leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 2.8.0 is able to address this issue.

Recommendation

Update the layui package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.8.0
• Patched version(s): 2.8.0

References

• GHSA-hx4h-676r-j3qp
• gitee.com
• vuldb.com
• CVE-2023-3691
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• tarteaucitron Cross-site Scripting (XSS) - CVE-2025-1467
• Cross site scripting in markdown-to-jsx - CVE-2024-21535
• uPlot Prototype Pollution vulnerability - CVE-2024-21489
• Layui has DOM Clobbering gadgets that leads to Cross-site Scripting - CVE-2024-47075

Tags:

npm

layui