Description
Versions of metascraper prior to 5.2.0 are vulnerable to stored cross-site scripting (XSS).
Recommendation
Update the metascraper package to the latest compatible version. Followings are version details:
- Affected version(s): < 5.2.0
- Patched version(s): 5.2.0
References
Related Issues
- Nuxt has Client-Side Path Traversal in Nuxt Island Payload Revival - CVE-2025-59414
- Linkify Allows Prototype Pollution & HTML Attribute Injection (XSS) - CVE-2025-8101
- Marked allows Regular Expression Denial of Service (ReDoS) attacks - CVE-2018-25110
- tarteaucitron.js allows url scheme injection via unfiltered inputs - CVE-2025-31476
- Tags:
- npm
- metascraper
Anything's wrong? Let us know Last updated on January 31, 2023