GHSA-vp4f-wxgw-7x8xHighCVSS 7.5

Improper Neutralization of Script in Attributes in @dcl/single-sign-on-client

Published
September 4, 2023
Last Modified
November 5, 2023

🔗 CVE IDs covered (1)

CVE-2023-41049 →

📋 Description

Impact

Improper input validation in the init function allows arbitrary javascript to be executed using the javascript: prefix

    SSO.init('javascript:alert("javascript successfully injected")')

Patches

This vulnerability was patched on version 0.1.0

Workarounds

This vulnerability can be prevented if user input correctly sanitized or there is no user input pass to the init function

🎯 Affected products1

  • npm/@dcl/single-sign-on-client:< 0.1.0

🔗 References (5)