Reflected Cross-Site Scripting in jquery.terminal

Description

Versions of jquery.terminal prior to 1.21.0 are vulnerable to Reflected Cross-Site Scripting. If the application has either of the options anyLinks or invokeMethods set to true, the application may execute arbitrary JavaScript through crafted malicious payloads due to insufficient sanitization.

Recommendation

Update the jquery.terminal package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.21.0
• Patched version(s): 1.21.0

References

• GHSA-2hwp-g4g7-mwwj
• www.npmjs.com
• CWE-79
• OWASP 2021-A3

Related Issues

• Auth0 NextJS SDK v4 Missing Session Invalidation - CVE-2025-46344
• Potential DoS when using ContextLines integration - Vulnerability
• sanitize-html Information Exposure vulnerability - CVE-2024-21501
• json-schema-ref-parser Prototype Pollution issue - CVE-2024-29651

Tags:

npm

jquery.terminal