What is GHSA-gm29-35c7-8cfw?

GHSA-gm29-35c7-8cfw is a security advisory published by GitHub Security Advisories with High severity. Cross-Site Scripting in buttle

Which CVE IDs does GHSA-gm29-35c7-8cfw cover?

GHSA-gm29-35c7-8cfw covers the following CVE IDs: CVE-2019-5422. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-gm29-35c7-8cfw?

GHSA-gm29-35c7-8cfw affects 1 product, including: npm/buttle:\u003c= 0.2.0.

GHSA-gm29-35c7-8cfwHigh

Cross-Site Scripting in buttle

Vendor

GitHub Security Advisories

Published

April 8, 2019

Last Modified

January 9, 2023

🔗 CVE IDs covered (1)

CVE-2019-5422 →

📋 Description

All versions of buttle are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.

Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

🎯 Affected products1

npm/buttle:<= 0.2.0

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2019-5422
https://hackerone.com/reports/331032
https://github.com/advisories/GHSA-gm29-35c7-8cfw
https://www.npmjs.com/advisories/667
https://hackerone.com/reports/331110
https://www.npmjs.com/advisories/1009