pym.js CSRF Vulnerability

Description

NPR Visuals Team Pym.js version versions 0.4.2 up to 1.3.1 contains a Cross Site Request Forgery (CSRF) vulnerability in Pym.js _onNavigateToMessage function.

https://github.com/nprapps/pym.js/blob/master/src/pym.js#L573 can result in Arbitrary javascript code execution.

Recommendation

Update the pym.js package to the latest compatible version. Followings are version details:

• Affected version(s): >= 0.4.2, <= 1.3.1
• Patched version(s): 1.3.2

References

• GHSA-82gw-pqf7-q3j2
• blog.apps.npr.org
• CVE-2018-1000086
• CWE-352
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• SimpleMDE XSS Vulnerability - CVE-2018-19057
• skeemas Inefficient Regular Expression Complexity vulnerability - CVE-2018-25074
• is-url Inefficient Regular Expression Complexity vulnerability - CVE-2018-25079
• Angular Redactor XSS Vulnerability - CVE-2018-13339

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

Exploiting Server Version Disclosure

How do hackers hack websites?

Tags:

npm

pym.js