What is GHSA-jj6g-7j8p-7gf2?

GHSA-jj6g-7j8p-7gf2 is a security advisory published by GitHub Security Advisories with High severity. Cross-Site Scripting in bracket-template

Why does GHSA-jj6g-7j8p-7gf2 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-jj6g-7j8p-7gf2?

GHSA-jj6g-7j8p-7gf2 affects 1 product, including: npm/bracket-template:\u003c= 1.1.5.

GHSA-jj6g-7j8p-7gf2HighDisclosed before NVD

Cross-Site Scripting in bracket-template

Vendor

GitHub Security Advisories

Published

May 30, 2019

Last Modified

January 9, 2023

📋 Description

All versions of bracket-template are vulnerable to stored cross-site scripting (XSS). This is exploitable when a variable passed in via a GET parameter is used in a template.

Recommendation

No fix is currently available for this vulnerability. It is our recommendation to not install or use this module at this time.

🎯 Affected products1

npm/bracket-template:<= 1.1.5

🔗 References (3)

https://hackerone.com/reports/317125
https://www.npmjs.com/advisories/608
https://github.com/advisories/GHSA-jj6g-7j8p-7gf2