Description
Svelecte item names are rendered as raw HTML with no escaping. This allows the injection of arbitrary HTML into the Svelecte dropdown. This can be exploited to execute arbitrary JavaScript whenever a Svelecte dropdown is opened.
Recommendation
Update the svelecte package to the latest compatible version. Followings are version details:
- Affected version(s): < 3.16.3
- Patched version(s): 3.16.3
References
Could your website be exposed too?
SmartScanner can check your website for Svelecte item names vulnerable to execution of arbitrary JavaScript and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code - CVE-2023-45133
- PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF - CVE-2024-4367
- Joplin is vulnerable to arbitrary code execution - CVE-2022-35131
- XSS vulnerability allowing arbitrary JavaScript execution - CVE-2021-41174
You might also like:
See something that needs correcting? Let us knowUpdated November 08, 2023