Описание
Cross-Site Scripting in shave
Versions of shave prior to 2.5.3 are vulnerable to Cross-Site Scripting. The shave package overwrites HTML elements and in doing so fails to properly encode the output. If encoded HTML input is passed into shave the output will be decoded which may lead to Cross-Site Scripting.
Recommendation
Upgrade to version 2.5.3 or later.
Пакеты
Наименование
shave
npm
Затронутые версииВерсия исправления
< 2.5.3
2.5.3
Связанные уязвимости
CVSS3: 6.1
nvd
больше 6 лет назад
XSS exists in Shave before 2.5.3 because output encoding is mishandled during the overwrite of an HTML element.