PT-2020-21225 · @Berslucas · @Berslucas/Liljs

Published 2020-09-03 · Updated 2020-09-03

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions @berslucas/liljs versions prior to 1.0.2

Description The issue concerns the use of the unsafe innerHTML function without input sanitization, potentially allowing attackers to execute arbitrary JavaScript on a victim's browser, thus facilitating Cross-Site Scripting (XSS) attacks.

Recommendations Upgrade to version 1.0.2 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-C53X-WWX2-PG96

Affected Products

@Berslucas/Liljs

References · 7

• https://osv.dev/vulnerability/GHSA-c53x-wwx2-pg96 · Vendor Advisory
• https://github.com/bersLucas/liljs · Note
• https://github.com/bersLucas/liljs/pull/7 · Note
• https://github.com/bersLucas/liljs/commit/779c0dcd8aba434a1c94db7d1d2d990a629f9a6c · Note
• https://github.com/bersLucas/liljs/releases/tag/1.0.2 · Note
• https://npmjs.com/advisories/1016 · Note
• https://snyk.io/vuln/SNYK-JS-BERSLUCASLILJS-450217 · Note