What is GHSA-7752-f4gf-94gc?

GHSA-7752-f4gf-94gc is a security advisory published by GitHub Security Advisories with Medium severity. Materialize-css vulnerable to Cross-site Scripting in autocomplete component

Which CVE IDs does GHSA-7752-f4gf-94gc cover?

GHSA-7752-f4gf-94gc covers the following CVE IDs: CVE-2019-11003. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7752-f4gf-94gc?

GHSA-7752-f4gf-94gc has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-7752-f4gf-94gc?

GHSA-7752-f4gf-94gc affects 2 products, including: npm/materialize-css:\u003c= 1.0.0; npm/@materializecss/materialize:\u003c 1.1.0-alpha.

GHSA-7752-f4gf-94gcMediumCVSS 6.1

Materialize-css vulnerable to Cross-site Scripting in autocomplete component

Vendor

GitHub Security Advisories

Published

April 9, 2019

Last Modified

August 28, 2023

🔗 CVE IDs covered (1)

CVE-2019-11003 →

📋 Description

All versions of materialize-css are vulnerable to Cross-Site Scripting. The autocomplete component does not sufficiently sanitize user input, allowing an attacker to execute arbitrary JavaScript code if the malicious input is rendered by a user.

Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.

🎯 Affected products2

npm/materialize-css:<= 1.0.0
npm/@materializecss/materialize:< 1.1.0-alpha

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2019-11003
https://github.com/Dogfalo/materialize/issues/6286
https://snyk.io/vuln/SNYK-JS-MATERIALIZECSS-174144
https://github.com/materializecss/materialize/pull/49
https://github.com/advisories/GHSA-7752-f4gf-94gc