Описание
Cross-Site Scripting in vant
Versions of vant prior to 2.1.8 are vulnerable to Cross-Site Scripting. The text value of the Picker component column is not sanitized, which may allow attackers to execute arbitrary JavaScript in a victim's browser.
Recommendation
Upgrade to version 2.1.8 or later.
Пакеты
Наименование
vant
npm
Затронутые версииВерсия исправления
< 2.1.8
2.1.8
9.1 Critical
CVSS3
Дефекты
CWE-79
9.1 Critical
CVSS3
Дефекты
CWE-79