Stage.js DOM Clobbering vulnerabilty

Description

Stage.js through 0.8.10 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 0.8.10

References

• GHSA-fp3m-g5rc-4c28
• CVE-2024-53386
• CWE-79
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS - CVE-2024-47068
• Layui has DOM Clobbering gadgets that leads to Cross-site Scripting - CVE-2024-47075
• DOM clobbering could escalate to Cross-site Scripting (XSS) - @pagefind/default-ui - CVE-2024-45389
• Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSS - CVE-2024-43788

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

stage-js