PT-2020-20957 · Hapi · @Hapi/Boom

Published 2020-09-04 · Updated 2020-09-04

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions @hapi/boom versions prior to 0.3.8

Description The issue arises from the package's failure to properly escape error messages, potentially allowing attackers to execute arbitrary JavaScript in a victim's browser. This could lead to Cross-Site Scripting (XSS) attacks.

Recommendations Upgrade to version 0.3.8 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-2GGQ-VFCP-GWHJ

Affected Products

@Hapi/Boom

References · 4

• https://osv.dev/vulnerability/GHSA-2ggq-vfcp-gwhj · Vendor Advisory
• https://github.com/hapijs/boom/commit/0f8640bdba65aec6e6799bfc16ff5753150bfcaf · Note
• https://github.com/hapijs/boom · Note
• https://snyk.io/vuln/SNYK-JS-HAPIBOOM-541183 · Note