Ishmeals

**Name of the Vulnerable Software and Affected Versions** Astro versions 3.0.0 through 4.16.0 **Description** The Astro web framework has a DOM Clobbering gadget in the client-side router. This issue can lead to cross-site scripting (XSS) in websites that enable Astro's client-side routing and have stored attacker-controlled scriptless HTML elements, such as `iframe` tags with unsanitized `name` attributes, on the destination pages. The vulnerability can result in XSS attacks on websites built with Astro that enable client-side routing with `ViewTransitions` and store user-inserted scriptless HTML tags without properly sanitizing the `name` attributes on the page. **Recommendations** For Astro versions 3.0.0 through 4.16.0, update to version 4.16.1 or later to resolve the issue. As a temporary workaround, consider disabling the client-side routing feature until a patch is applied. Restrict access to the client-side router module to minimize the risk of exploitation. Avoid using unsanitized `name` attributes in `iframe` tags within the affected API endpoints until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** LayUI versions prior to 2.9.17 **Description** The issue is related to a DOM Clobbering vulnerability that can lead to Cross-site Scripting (XSS) on web pages where attacker-controlled HTML elements, such as `img` tags with unsanitized `name` attributes, are present. This vulnerability can be exploited due to the presence of unsanitized attributes in HTML elements. **Recommendations** For versions prior to 2.9.17, update to version 2.9.17 to fix the issue. As a temporary workaround, consider sanitizing user-controlled input, especially attributes of HTML elements like `name` in `img` tags, to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Rollup versions prior to 2.79.2, 3.29.5, and 4.22.4 **Description** The issue is related to a DOM Clobbering vulnerability in Rollup when bundling scripts with properties from `import.meta` (e.g., `import.meta.url`) in `cjs`/`umd`/`iife` format. This vulnerability can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an `img` tag with an unsanitized `name` attribute) are present. The DOM Clobbering gadget can be exploited by an attacker to load scripts from an attacker-controlled server. **Recommendations** For versions prior to 2.79.2, update to version 2.79.2 or later. For versions prior to 3.29.5, update to version 3.29.5 or later. For versions prior to 4.22.4, update to version 4.22.4 or later.

**Name of the Vulnerable Software and Affected Versions** CodiMD versions prior to 2.5.4 **Description** The notebook feature of Hackmd.io permits the rendering of iframe `HTML` tags with an improperly sanitized `name` attribute. This enables attackers to perform cross-site scripting (XSS) attacks via DOM clobbering. **Recommendations** For versions prior to 2.5.4, update to version 2.5.4 to resolve the issue. As a temporary workaround, consider restricting the rendering of iframe `HTML` tags or sanitizing the `name` attribute to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** CoCalc versions prior to the version containing commit 419862a9c9879c **Description** The issue concerns the markdown parser in CoCalc, which allows `<script>` tags to be included and executed when published. There are no known workarounds for this issue. **Recommendations** For versions prior to the version containing commit 419862a9c9879c, upgrade to a version that includes the fix.