GHSA-pxpf-v376-7xx5MediumCVSS 6.1

tagify can pass a malicious placeholder to initiate the cross-site scripting (XSS) payload

Published
April 30, 2022
Last Modified
January 30, 2023

🔗 CVE IDs covered (1)

CVE-2022-25854 →

📋 Description

This affects the package @yaireo/tagify before 4.9.8. The package is used for rendering UI components inside the input or text fields, and an attacker can pass a malicious placeholder value to it to fire the cross-site scripting (XSS) payload.

🎯 Affected products1

  • npm/@yaireo/tagify:< 4.9.8

🔗 References (7)