PT-2024-27350 · Ghtml · Ghtml

Lirantal · Published 2024-06-10 · Updated 2024-06-11 · CVE-2024-37166

Positive Technologies (AI Summary)

CVSS v3.1

8.9

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions ghtml versions prior to 2.0.0

Description The issue allows for the introduction of user-controlled JavaScript code, potentially triggering a Cross-Site Scripting (XSS) vulnerability in certain cases. Developers should be cautious and take additional measures to sanitize user input and prevent potential vulnerabilities. The backtick character (`) is now also escaped to prevent the creation of strings in most cases where a malicious actor gains the ability to write JavaScript. However, this does not provide comprehensive protection against all types of XSS attacks.

Recommendations For versions prior to 2.0.0, update to version 2.0.0 to address the Cross-Site Scripting vulnerabilities. Additionally, consider implementing extra sanitization measures for user input to enhance cybersecurity. As a temporary workaround, consider restricting the use of user-controlled input in template engine functionality until the issue is fully resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

CWE-79

Related Identifiers

CVE-2024-37166

GHSA-VVHJ-V88F-5GXR

Affected Products

Ghtml

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37166.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-37166 · Security Note
• https://osv.dev/vulnerability/GHSA-vvhj-v88f-5gxr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-37166 · Vendor Advisory
• https://github.com/gurgunday/ghtml/security/advisories/GHSA-vvhj-v88f-5gxr · Note
• https://github.com/gurgunday/ghtml/commit/df1ea50fe8968a766fd2b9379a8f9806375227f8 · Note
• https://github.com/gurgunday/ghtml · Note
• https://twitter.com/CVEnew/status/1800281203569840238 · Twitter Post
• https://twitter.com/CveFindCom/status/1800287094931120333 · Twitter Post