rendertron XSS vulnerability

Description

Error reporting within Rendertron 1.0.0 allows reflected Cross Site Scripting (XSS) from invalid URLs.

Recommendation

Update the rendertron package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.1.0
• Patched version(s): 1.1.0

References

• GHSA-j88m-953w-8r2c
• bugs.chromium.org
• CVE-2017-18352
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• rendertron LFI vulnerability - CVE-2017-18354
• XSS vulnerability allowing arbitrary JavaScript execution - CVE-2021-41174
• Rendertron discloses absolute paths of files - CVE-2017-18355
• Marked vulnerable to XSS from data URIs - CVE-2017-1000427

Tags:

npm

rendertron