What is GHSA-g9wg-wq4f-2x5w?

GHSA-g9wg-wq4f-2x5w is a security advisory published by GitHub Security Advisories with High severity. Cross-Site Scripting in console-feed

Why does GHSA-g9wg-wq4f-2x5w have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-g9wg-wq4f-2x5w?

GHSA-g9wg-wq4f-2x5w affects 1 product, including: npm/console-feed:\u003c 2.8.10.

GHSA-g9wg-wq4f-2x5wHighDisclosed before NVD

Cross-Site Scripting in console-feed

Vendor

GitHub Security Advisories

Published

September 3, 2020

Last Modified

January 9, 2023

📋 Description

Versions of console-feed prior to 2.8.10 are vulnerable to Cross-Site Scripting (XSS). The package fails to properly escape the rendered output. If an application uses console-feed and a malicious JavaScript payload was passed to a console.log('%_', payload) call, the package would render HTML containing the malicious payload.

Recommendation

Upgrade to version 2.8.10 or later.

🎯 Affected products1

npm/console-feed:< 2.8.10

🔗 References (2)

https://www.npmjs.com/advisories/1088
https://github.com/advisories/GHSA-g9wg-wq4f-2x5w