Reflected cross-site scripting (XSS) vulnerability

Description

This security advisory relates to a capability for an attacker to exploit a reflected cross-site scripting vulnerability when using the @keystone-6/auth package.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 37.0.0

References

• GHSA-hrgx-7j6v-xj82
• huntr.dev
• CVE-2022-0087
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Code Snippet GeSHi plugin in CKEditor 4 has reflected cross-site scripting (XSS) vulnerability - CVE-2024-43407
• VvvebJs Reflected Cross-Site Scripting (XSS) vulnerability - CVE-2024-29271
• wangEditor was discovered to contain a cross-site scripting (XSS) vulnerability via the image upload function - CVE-2022-25037
• CKEditor5 cross-site scripting vulnerability caused by the editor instance destroying process - @ckeditor/ckeditor5-html-support - CVE-2022-31175

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

How do hackers hack websites?

These 7 PHP mistakes leave your website open to the hackers

Tags:

npm

@keystone-next/auth