GHSA-9v3w-m552-m6ffMediumCVSS 6.1

Pi Cross-site Scripting vulnerability

Published
May 13, 2022
Last Modified
July 7, 2023

🔗 CVE IDs covered (1)

CVE-2017-7251 →

📋 Description

A Cross-Site Scripting (XSS) was discovered in pi-engine/pi 2.5.0. The vulnerability exists due to insufficient filtration of user-supplied data (preview) passed to the pi-develop/www/script/editor/markitup/preview/markdown.php URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.

🎯 Affected products1

  • composer/pi/pi:<= 2.5.0

🔗 References (5)