rendertron XSS vulnerability

Description

Error reporting within Rendertron 1.0.0 allows reflected Cross Site Scripting (XSS) from invalid URLs.

Recommendation

Update the rendertron package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.1.0
• Patched version(s): 1.1.0

References

• GHSA-j88m-953w-8r2c
• bugs.chromium.org
• CVE-2017-18352
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• EpicEditor XSS Vulnerability - CVE-2017-6589
• rendertron LFI vulnerability - CVE-2017-18354
• Nuxt MDC has an XSS vulnerability in markdown rendering that bypasses HTML filtering - CVE-2025-54075
• Decap CMS Cross Site Scripting (XSS) vulnerability - CVE-2025-57520

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

How do hackers hack websites?

These 7 PHP mistakes leave your website open to the hackers

Tags:

npm

rendertron