GHSA-p82g-2xpp-m5r3MediumCVSS 5.4

Cross-Site Scripting in dojo

Published
September 11, 2020
Last Modified
January 6, 2023

🔗 CVE IDs covered (1)

CVE-2015-5654 →

📋 Description

Versions of dojo prior to 1.2.0 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize HTML code in user-controlled input, allowing attackers to execute arbitrary JavaScript in the victim's browser.

Recommendation

Upgrade to version 1.2.0 or later.

🎯 Affected products1

  • npm/dojo:< 1.2.0

🔗 References (10)