rendertron XSS vulnerability

Description

Error reporting within Rendertron 1.0.0 allows reflected Cross Site Scripting (XSS) from invalid URLs.

Recommendation

Update the rendertron package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.1.0
• Patched version(s): 1.1.0

References

• GHSA-j88m-953w-8r2c
• bugs.chromium.org
• CVE-2017-18352
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• rendertron LFI vulnerability - CVE-2017-18354
• Cross-site Scripting in quill - CVE-2021-3163
• Prototype Pollution in async - CVE-2021-43138
• Joplin Remote Code Execution - CVE-2022-40277

Tags:

npm

rendertron