Description
All versions of package materialize-css are vulnerable to Cross-site Scripting (XSS) due to improper escape of user input (such as <not-a-tag />) that is being parsed as HTML/JavaScript, and inserted into the Document Object Model (DOM). This vulnerability can be exploited when the user-input is provided to the autocomplete component.
Recommendation
No fix is available yet. Followings are affected versions:
- <= 1.0.0
References
Could your website be exposed too?
SmartScanner can check your website for materialize-css vulnerable to cross-site Scripting (XSS) due to improper escape of user input and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Materialize-css vulnerable to Cross-site Scripting in tooltip component - materialize-css - CVE-2019-11002
- Materialize-css vulnerable to Cross-site Scripting in autocomplete component - materialize-css - CVE-2019-11003
- Materialize-css vulnerable to Improper Neutralization of Input During Web Page Generation - materialize-css - CVE-2019-11004
- Materialize-css vulnerable to Cross-site Scripting in tooltip component - CVE-2019-11002
You might also like:
See something that needs correcting? Let us knowUpdated February 01, 2023