Description
There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it.
Recommendation
Update the knockout package to the latest compatible version. Followings are version details:
- Affected version(s): < 3.5.0
- Patched version(s): 3.5.0
References
Could your website be exposed too?
SmartScanner can check your website for XSS in knockout and gives you actionable findings to investigate.
Start a free scanRelated Issues
- hexo-admin plugin for Node.js XSS Vulnerability - CVE-2019-17606
- XSS in dojox due to insufficient escape in dojox.xmpp.util.xmlEncode - CVE-2019-10785
- XSS in jQuery as used in Drupal, Backdrop CMS, and other products - CVE-2019-11358
- XSS in TinyMCE - CVE-2019-1010091
You might also like:
See something that needs correcting? Let us knowUpdated February 01, 2023