Saltcorn Server Stored Cross-Site Scripting (XSS) in event logs page
- Severity:
- Medium
Description
Event log data is not properly sanitized leading to stored Cross-Site Scripting (XSS) vulnerability.
Recommendation
Update the @saltcorn/server package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.0.0-beta.16
- Patched version(s): 1.0.0-beta.16
References
Related Issues
- Finance.js vulnerable to DoS via the IRR function’s depth parameter - CVE-2025-56571
- Mermaid improperly sanitizes sequence diagram labels leading to XSS - CVE-2025-54881
- Payload does not invalidate JWTs after log out (GHSA-5v66-m237-hwf7) - CVE-2025-4643
- Vite's server.fs.deny bypassed with /. for files under project root - CVE-2025-46565
- Tags:
- npm
- @saltcorn/server
Anything's wrong? Let us know Last updated on October 07, 2024