@urql/next Cross-site Scripting vulnerability

Description

The @urql/next package is vulnerable to XSS. To exploit this an attacker would need to ensure that the response returns html tags and that the web-application is using streamed responses (non-RSC). This vulnerability is due to improper escaping of html-like characters in the response-stream.

To fix this vulnerability upgrade to version 1.1.1

Recommendation

Update the @urql/next package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.1.1
• Patched version(s): 1.1.1

References

• GHSA-qhjf-hm5j-335w
• CVE-2024-24556
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Stimulsoft Dashboard.JS Cross Site Scripting vulnerability - CVE-2024-24396
• Trix has a cross-site Scripting vulnerability on copy & paste - CVE-2024-43368
• SummerNote Cross Site Scripting Vulnerability - CVE-2024-37629
• ghtml Cross-Site Scripting (XSS) vulnerability - CVE-2024-37166

Tags:

npm

@urql/next