GHSA-39cx-xcwj-3rc4Medium
Cross-Site Scripting in dojo
🔗 CVE IDs covered (1)
📋 Description
Affected versions of dojo are susceptible to a cross-site scripting vulnerability in the dijit.Editor and textarea components, which execute their contents as Javascript, even when sanitized.
Recommendation
Update to version 1.1.0 or later.
🎯 Affected products1
- npm/dojo:< 1.1.0
🔗 References (9)
- https://bugs.dojotoolkit.org/ticket/2140
- https://www.npmjs.com/advisories/107
- https://nvd.nist.gov/vuln/detail/CVE-2008-6681
- https://exchange.xforce.ibmcloud.com/vulnerabilities/49883
- http://trac.dojotoolkit.org/ticket/2140
- http://www.dojotoolkit.org/book/dojo-1-1-release-notes
- http://www.securityfocus.com/bid/34661
- http://trac.dojotoolkit.org/changeset/15346
- https://github.com/advisories/GHSA-39cx-xcwj-3rc4