SQL Injection and Cross-site Scripting in class-validator

Description

In TypeStack class-validator, validate() input validation can be bypassed because certain internal attributes can be overwritten via a conflicting name.

Recommendation

Update the class-validator package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.14.0
• Patched version(s): 0.14.0

References

• GHSA-fj58-h2fr-3pp2
• CVE-2019-18413
• CWE-79
• CWE-89
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• AngularJS Cross-site Scripting due to failure to sanitize `xlink.href` attributes - CVE-2019-14863
• Materialize-css vulnerable to Cross-site Scripting in tooltip component - materialize-css - CVE-2019-11002
• Materialize-css vulnerable to Cross-site Scripting in tooltip component - CVE-2019-11002
• DOM-based cross-site scripting in Froala Editor - CVE-2019-19935

You might also like:

44 New SQL Injection Tests for WordPress in SmartScanner 1.8

How do hackers hack websites?

Update Cheat Sheet for Developers

Tags:

npm

class-validator