What is GHSA-qhjf-hm5j-335w?

GHSA-qhjf-hm5j-335w is a security advisory published by GitHub Security Advisories with High severity. @urql/next Cross-site Scripting vulnerability

Which CVE IDs does GHSA-qhjf-hm5j-335w cover?

GHSA-qhjf-hm5j-335w covers the following CVE IDs: CVE-2024-24556. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qhjf-hm5j-335w?

GHSA-qhjf-hm5j-335w has a CVSS v3 base score of 7.2, published by GitHub Security Advisories.

Which products are affected by GHSA-qhjf-hm5j-335w?

GHSA-qhjf-hm5j-335w affects 1 product, including: npm/@urql/next:\u003c 1.1.1.

GHSA-qhjf-hm5j-335wHighCVSS 7.2

@urql/next Cross-site Scripting vulnerability

Vendor

GitHub Security Advisories

Published

January 30, 2024

Last Modified

January 30, 2024

🔗 CVE IDs covered (1)

CVE-2024-24556 →

📋 Description

impact

The @urql/next package is vulnerable to XSS. To exploit this an attacker would need to ensure that the response returns html tags and that the web-application is using streamed responses (non-RSC). This vulnerability is due to improper escaping of html-like characters in the response-stream.

To fix this vulnerability upgrade to version 1.1.1

🎯 Affected products1

npm/@urql/next:< 1.1.1

🔗 References (4)

https://github.com/urql-graphql/urql/security/advisories/GHSA-qhjf-hm5j-335w
https://nvd.nist.gov/vuln/detail/CVE-2024-24556
https://github.com/urql-graphql/urql/commit/4b7011b70d5718728ff912d02a4dbdc7f703540d
https://github.com/advisories/GHSA-qhjf-hm5j-335w