Description
Versions of validator prior to 1.1.0 are affected by several cross-site scripting vulnerabilities due to bypasses discovered in the blacklist-based filter.
Recommendation
Update the validator package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.1.0
- Patched version(s): 1.1.0
References
- GHSA-q4qq-fm7q-cwp5
- nealpoole.com
- www.npmjs.com
- blog.kotowicz.net
- www.openwall.com
- CVE-2013-7454
- CWE-79
- CAPEC-310
- OWASP 2021-A3
- OWASP 2021-A6
Related Issues
- XSS Filter Bypass via Encoded URL in validator - CVE-2014-9772
- Moderate severity vulnerability that affects validator (GHSA-rh6c-q938-3r9q) - CVE-2013-7452
- Moderate severity vulnerability that affects validator (GHSA-552w-rqg8-gxxm) - CVE-2013-7453
- Moderate severity vulnerability that affects validator - CVE-2013-7451
- Tags:
- npm
- validator
Anything's wrong? Let us know Last updated on January 09, 2023