PT-2024-39633 · Unknown · Slim Select

Alexis Marquois

·

Published

2024-10-02

·

Updated

2024-11-13

·

CVE-2024-9440

CVSS v3.1

6.1

Medium

VectorAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Slim Select versions 2.0 through 2.9.0
Description The issue is a potential cross-site scripting vulnerability. In the createOption() function, the text variable from the user-provided Options object is assigned to an innerHTML without sanitation. This may allow attackers to execute JavaScript, resulting in cross-site scripting. Software that depends on this library to dynamically generate lists using unsanitized user-provided input may be vulnerable.
Recommendations For Slim Select versions 2.0 through 2.9.0, consider updating to version 2.9.2, which includes a fix for this issue. For versions prior to 2.9.2, as a temporary workaround, consider sanitizing the text variable from the user-provided Options object before assigning it to an innerHTML to prevent cross-site scripting. Restrict access to the createOption() function in select.ts to minimize the risk of exploitation until a patch is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-9440
GHSA-QVQV-MCXR-X8QW

Affected Products

Slim Select