Описание
Cross-Site Scripting in @berslucas/liljs
Versions of @berslucas/liljs prior to 1.0.2 are vulnerable to Cross-Site Scripting (XSS). The package uses the unsafe innerHTML function without sanitizing input, which may allow attackers to execute arbitrary JavaScript on the victim's browser.
Recommendation
Upgrade to version 1.0.2 or later.
Пакеты
Наименование
@berslucas/liljs
npm
Затронутые версииВерсия исправления
< 1.0.2
1.0.2
6.5 Medium
CVSS3
Дефекты
CWE-79
6.5 Medium
CVSS3
Дефекты
CWE-79