What is GHSA-v5hp-35hw-cw5x?

GHSA-v5hp-35hw-cw5x is a security advisory published by GitHub Security Advisories with High severity. XSS in client rendered block templates in rendr

Which CVE IDs does GHSA-v5hp-35hw-cw5x cover?

GHSA-v5hp-35hw-cw5x covers the following CVE IDs: CVE-2016-1000230. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-v5hp-35hw-cw5x?

GHSA-v5hp-35hw-cw5x affects 1 product, including: npm/rendr:\u003c= 1.1.3.

GHSA-v5hp-35hw-cw5xHigh

XSS in client rendered block templates in rendr

Vendor

GitHub Security Advisories

Published

September 1, 2020

Last Modified

January 9, 2023

🔗 CVE IDs covered (1)

CVE-2016-1000230 →

📋 Description

Affected versions of rendr are vulnerable to cross-site scripting when client side rendering is done inside a _block.

Server side rendering is not affected and is properly escaped.

Recommendation

Update to version 1.1.4 or later.

🎯 Affected products1

npm/rendr:<= 1.1.3

🔗 References (5)

https://github.com/rendrjs/rendr-handlebars/pull/61
https://github.com/rendrjs/rendr/pull/513
https://www.npmjs.com/advisories/128
https://nvd.nist.gov/vuln/detail/CVE-2016-1000230
https://github.com/advisories/GHSA-v5hp-35hw-cw5x