PT-2019-13374 · Nuxt · @Nuxt/Devalue+1

Published 2019-07-11 · Updated 2019-07-18 · CVE-2019-13506

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions @Nuxt/devalue versions prior to 1.2.3 Nuxt.js versions prior to 2.6.2

Description The issue is related to the mishandling of object keys, leading to Cross-Site Scripting (XSS). Insufficient input sanitization allows an attacker to inject arbitrary JavaScript code through object keys.

Recommendations For @Nuxt/devalue versions prior to 1.2.3, upgrade to version 1.2.3 or later. For Nuxt.js versions prior to 2.6.2, upgrade to version 2.6.2 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-13506

GHSA-6677-83PP-F862

Affected Products

@Nuxt/Devalue

Nuxt.Js

References · 10

• https://github.com/nuxt/nuxt.js/commit/0d5dfe71917191c5b07f373896311f2d8f6b75be · Patch
• https://github.com/nuxt/devalue/pull/8 · Patch
• https://osv.dev/vulnerability/GHSA-6677-83pp-f862 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-13506 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-13506 · Security Note
• https://github.com/nuxt/nuxt.js/releases/tag/v2.6.2 · Note
• https://github.com/nuxt/nuxt.js/compare/c0776eb...8d14cd4 · Note
• https://github.com/Rich-Harris/devalue/issues/19 · Note
• https://github.com/nuxt/devalue/releases/tag/v1.2.3 · Note
• https://npmjs.com/advisories/814 · Note