What is GHSA-7jfh-2xc9-ccv7?

GHSA-7jfh-2xc9-ccv7 is a security advisory published by GitHub Security Advisories with Low severity. Cross-Site Scripting in public

Why does GHSA-7jfh-2xc9-ccv7 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-7jfh-2xc9-ccv7?

GHSA-7jfh-2xc9-ccv7 affects 2 products, including: npm/public:\u003c 0.1.4; npm/public:= 0.1.5.

GHSA-7jfh-2xc9-ccv7LowDisclosed before NVD

Cross-Site Scripting in public

Vendor

GitHub Security Advisories

Published

May 31, 2019

Last Modified

January 9, 2023

📋 Description

All versions of public are vulnerable to stored cross-site scripting (XSS).

Recommendation

No fix is currently available for this vulnerability. It is our recommendation to not install or use this module at this time.

🎯 Affected products2

npm/public:< 0.1.4
npm/public:= 0.1.5

🔗 References (3)

https://hackerone.com/reports/316346
https://www.npmjs.com/advisories/609
https://github.com/advisories/GHSA-7jfh-2xc9-ccv7