@urql/next Cross-site Scripting vulnerability

Description

The @urql/next package is vulnerable to XSS. To exploit this an attacker would need to ensure that the response returns html tags and that the web-application is using streamed responses (non-RSC). This vulnerability is due to improper escaping of html-like characters in the response-stream.

To fix this vulnerability upgrade to version 1.1.1

Recommendation

Update the @urql/next package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.1.1
• Patched version(s): 1.1.1

References

• GHSA-qhjf-hm5j-335w
• CVE-2024-24556
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6