What is GHSA-89q5-mj78-pw5w?

GHSA-89q5-mj78-pw5w is a security advisory published by GitHub Security Advisories with Medium severity. Cross-site Scripting in pekeupload

Which CVE IDs does GHSA-89q5-mj78-pw5w cover?

GHSA-89q5-mj78-pw5w covers the following CVE IDs: CVE-2021-23673. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-89q5-mj78-pw5w?

GHSA-89q5-mj78-pw5w has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-89q5-mj78-pw5w?

GHSA-89q5-mj78-pw5w affects 1 product, including: npm/pekeupload:\u003c= 2.1.1.

GHSA-89q5-mj78-pw5wMediumCVSS 6.1

Cross-site Scripting in pekeupload

Vendor

GitHub Security Advisories

Published

December 2, 2021

Last Modified

February 1, 2023

🔗 CVE IDs covered (1)

CVE-2021-23673 →

📋 Description

This affects all versions of package pekeupload. If an attacker induces a user to upload a file whose name contains javascript code, the javascript code will be executed.

🎯 Affected products1

npm/pekeupload:<= 2.1.1

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2021-23673
https://github.com/moxiecode/plupload/blob/120cc0b5dd3373d7181fd11b06ac2557c890d3f0/js/jquery.plupload.queue/jquery.plupload.queue.js%23L226
https://snyk.io/vuln/SNYK-JS-PEKEUPLOAD-1584360
https://github.com/advisories/GHSA-89q5-mj78-pw5w