Saltcorn Server Stored Cross-Site Scripting (XSS) in event logs page

Description

Event log data is not properly sanitized leading to stored Cross-Site Scripting (XSS) vulnerability.

Recommendation

Update the @saltcorn/server package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.0.0-beta.16
• Patched version(s): 1.0.0-beta.16

References

• GHSA-pf56-h9qf-rxq4
• CWE-79
• OWASP 2021-A3

Related Issues

• NotChatbot WebChat has a stored cross-site scripting (XSS) vulnerability - CVE-2026-30048
• wangEditor was discovered to contain a cross-site scripting (XSS) vulnerability via the image upload function - CVE-2022-25037
• Cross-Site Scripting (XSS) via Select Schema Option Value Injection in @pdfme/schemas - Vulnerability
• Cross-Site Scripting (XSS) via SVG Schema innerHTML Injection in @pdfme/schemas - Vulnerability

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

These 7 PHP mistakes leave your website open to the hackers

How do hackers hack websites?

Tags:

npm

@saltcorn/server