PT-2022-24950 · Unknown · Octocat.Js

Published 2022-11-08 · Updated 2022-11-09 · CVE-2022-39390

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions octocat.js versions prior to 1.2

Description The issue concerns JavaScript injection via user-provided URLs. Users can include their own images for accessories via provided URLs, which are not validated, resulting in the potential execution of injected code.

Recommendations For versions prior to 1.2, update to version 1.2 to resolve the issue. As a temporary workaround, consider writing an image to disk and then using that image in an image element in HTML to mitigate the risk.

Special Elements Injection

Code Injection

Weakness Enumeration

CWE-74

CWE-94

Related Identifiers

CVE-2022-39390

GHSA-R4JG-5V89-9V62

Affected Products

Octocat.Js

References · 5

• https://osv.dev/vulnerability/GHSA-r4jg-5v89-9v62 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39390 · Security Note
• https://github.com/octocademy/octocat.js · Note
• https://github.com/octocademy/octocat.js/security/advisories/GHSA-r4jg-5v89-9v62 · Note
• https://t.me/cibsecurity/52707 · Telegram Post