GHSA-vpch-rxw3-fgx8MediumCVSS 6.1

Cross-Site Scripting in @risingstack/protect

Published
April 25, 2018
Last Modified
January 9, 2023

🔗 CVE IDs covered (1)

CVE-2018-1000160 →

📋 Description

All versions of @risingstack/protect are vulnerable to Cross-Site Scripting. The isXss() XSS validator has several bypasses that may allow attackers to execute arbitrary JavaScript in a victim's browser.

Recommendation

No fix is currently available. Consider using an alternative package. The package is not actively maintained and will not be patched.

🎯 Affected products1

  • npm/@risingstack/protect:<= 1.2.0

🔗 References (7)