What is GHSA-pgr8-jg6h-8gw6?

GHSA-pgr8-jg6h-8gw6 is a security advisory published by GitHub Security Advisories with Medium severity. Cross-Site Scripting in webpack-bundle-analyzer

Why does GHSA-pgr8-jg6h-8gw6 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-pgr8-jg6h-8gw6?

GHSA-pgr8-jg6h-8gw6 has a CVSS v3 base score of 6.3, published by GitHub Security Advisories.

Which products are affected by GHSA-pgr8-jg6h-8gw6?

GHSA-pgr8-jg6h-8gw6 affects 1 product, including: npm/webpack-bundle-analyzer:\u003c 3.3.2.

GHSA-pgr8-jg6h-8gw6MediumCVSS 6.3Disclosed before NVD

Cross-Site Scripting in webpack-bundle-analyzer

Vendor

GitHub Security Advisories

Published

May 23, 2019

Last Modified

April 13, 2023

📋 Description

Versions of webpack-bundle-analyzer prior to 3.3.2 are vulnerable to Cross-Site Scripting. The package uses JSON.stringify() without properly escaping input which may lead to Cross-Site Scripting.

Recommendation

Upgrade to version 3.3.2 or later.

🎯 Affected products1

npm/webpack-bundle-analyzer:< 3.3.2

🔗 References (6)

https://github.com/webpack-contrib/webpack-bundle-analyzer/issues/263
https://github.com/webpack-contrib/webpack-bundle-analyzer/pull/264
https://snyk.io/vuln/SNYK-JS-WEBPACKBUNDLEANALYZER-174190
https://www.npmjs.com/advisories/826
https://github.com/webpack-contrib/webpack-bundle-analyzer/commit/20f2b4c553ee343f491faf63e39427fba9908c7c
https://github.com/advisories/GHSA-pgr8-jg6h-8gw6