mavo DOM Clobbering vulnerability

Description

A DOM Clobbering vulnerability in mavo v0.3.2 allows attackers to execute arbitrary code via supplying a crafted HTML element.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 0.3.2

References

• GHSA-3mf5-r4hg-hfx9
• CVE-2024-53388
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• PrismJS DOM Clobbering vulnerability - CVE-2024-53382
• DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS - CVE-2024-47068
• DOM Clobbering Gadget found in astro's client-side router that leads to XSS - CVE-2024-47885
• Layui has DOM Clobbering gadgets that leads to Cross-site Scripting - CVE-2024-47075

Tags:

npm

mavo