What is GHSA-rv8p-rr2h-fgpg?

GHSA-rv8p-rr2h-fgpg is a security advisory published by GitHub Security Advisories with High severity. @apollo/experimental-nextjs-app-support Cross-site Scripting vulnerability

Which CVE IDs does GHSA-rv8p-rr2h-fgpg cover?

GHSA-rv8p-rr2h-fgpg covers the following CVE IDs: CVE-2024-23841. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-rv8p-rr2h-fgpg?

GHSA-rv8p-rr2h-fgpg has a CVSS v3 base score of 8.2, published by GitHub Security Advisories.

Which products are affected by GHSA-rv8p-rr2h-fgpg?

GHSA-rv8p-rr2h-fgpg affects 1 product, including: npm/@apollo/experimental-nextjs-app-support:\u003c= 0.6.0.

GHSA-rv8p-rr2h-fgpgHighCVSS 8.2

@apollo/experimental-nextjs-app-support Cross-site Scripting vulnerability

Vendor

GitHub Security Advisories

Published

January 30, 2024

Last Modified

January 30, 2024

🔗 CVE IDs covered (1)

CVE-2024-23841 →

📋 Description

Impact

The @apollo/experimental-apollo-client-nextjs NPM package is vulnerable to a cross-site scripting vulnerability. This vulnerability arises from improper handling of untrusted input when @apollo/experimental-apollo-client-nextjs performs server-side rendering of HTML pages. To fix this vulnerability, we implemented appropriate escaping to prevent javascript injection into rendered pages.

Patches

To fix this issue, please update to version 0.7.0 or later.

Workarounds

There are no known workarounds for this issue. Please update to version 0.7.0

🎯 Affected products1

npm/@apollo/experimental-nextjs-app-support:<= 0.6.0

🔗 References (4)

https://github.com/apollographql/apollo-client-nextjs/security/advisories/GHSA-rv8p-rr2h-fgpg
https://nvd.nist.gov/vuln/detail/CVE-2024-23841
https://github.com/apollographql/apollo-client-nextjs/commit/b92bc42abd5f8e17d4db361c36bd08e4f541a46b
https://github.com/advisories/GHSA-rv8p-rr2h-fgpg