squirrelly Code Injection vulnerability

Description

squirrellyjs squirrelly v9.0.0 was discovered to contain a code injection vulnerability via the component options.varName. The issue was fixed in version 9.1.0.

Recommendation

Update the squirrelly package to the latest compatible version. Followings are version details:

• Affected version(s): >= 9.0.0, < 9.1.0
• Patched version(s): 9.1.0

References

• GHSA-w5pw-gmcw-rfc8
• samuzora.com
• CVE-2024-40453
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• tarteaucitron Cross-site Scripting (XSS) - CVE-2025-1467
• Cross site scripting in markdown-to-jsx - CVE-2024-21535
• uPlot Prototype Pollution vulnerability - CVE-2024-21489
• FUXA local file inclusion vulnerability - CVE-2023-31718

Tags:

npm

squirrelly