XSS in dojox due to insufficient escape in dojox.xmpp.util.xmlEncode

Description

Potential XSS vulnerability for users of dojox/xmpp and dojox/dtl.

Recommendation

Update the dojox package to the latest compatible version. Followings are version details:

• Affected version(s): **= 1.16.0

  >= 1.15.0, < 1.15.2

  >= 1.14.0, < 1.14.5

  >= 1.13.0, < 1.13.6

  >= 1.12.0, < 1.12.7

  < 1.11.9**

• Patched version(s): **1.16.1

  1.15.2

  1.14.5

  1.13.6

  1.12.7

  1.11.9**

References

• GHSA-pg97-ww7h-5mjr
• snyk.io
• lists.debian.org
• CVE-2019-10785
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6