PT-2020-7936 · Gmail-Js · Gmail-Js

Published 2020-09-01 · Updated 2020-09-01 · CVE-2016-1000228

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions: gmail-js versions prior to 0.6.5

Description: The issue concerns cross-site scripting in certain functions, specifically tools.parse response, helper.get.visible emails post, and helper.get.email data post, which directly pass user input into the Function constructor.

Recommendations: Update to version 0.6.5 or later.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2016-1000228

GHSA-C7PP-G2V2-2766

Affected Products

Gmail-Js

References · 6

• https://osv.dev/vulnerability/GHSA-c7pp-g2v2-2766 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-1000228 · Security Note
• https://github.com/KartikTalwar/gmail.js/commit/a83436f499f9c01b04280af945a5a81137b6baf1 · Note
• https://github.com/KartikTalwar/gmail.js/issues/281 · Note
• https://github.com/KartikTalwar/gmail.js · Note
• https://npmjs.com/advisories/125 · Note