Reflected XSS when using flashMessages or languageDictionary

Description

Versions before and including 11.30.0 are vulnerable to reflected XSS. An attacker can execute arbitrary code when the library’s

• flashMessage feature is utilized and user input or data from URL parameters is incorporated into the flashMessage.

Recommendation

Update the auth0-lock package to the latest compatible version. Followings are version details:

• Affected version(s): < 11.30.1
• Patched version(s): 11.30.1

References

• GHSA-jr3j-whm4-9wwm
• CVE-2021-32641
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Svelte vulnerable to XSS when using objects during server-side rendering - CVE-2022-25875
• Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode expressionInterpeter - CVE-2025-26619
• Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode expressionInterpeter - vega - CVE-2025-26619
• Plate media plugins has a XSS in media embed element when using custom URL parsers - CVE-2024-40631

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

CSRF, XXE, and 12 Other Security Acronyms Explained

How do hackers hack websites?

Tags:

npm

auth0-lock