What is GHSA-vwhg-jwr4-vxgg?

GHSA-vwhg-jwr4-vxgg is a security advisory published by GitHub Security Advisories with High severity. gettext.js has a Cross-site Scripting injection

Which CVE IDs does GHSA-vwhg-jwr4-vxgg cover?

GHSA-vwhg-jwr4-vxgg covers the following CVE IDs: CVE-2024-43370. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vwhg-jwr4-vxgg?

GHSA-vwhg-jwr4-vxgg has a CVSS v3 base score of 7.2, published by GitHub Security Advisories.

Which products are affected by GHSA-vwhg-jwr4-vxgg?

GHSA-vwhg-jwr4-vxgg affects 1 product, including: npm/gettext.js:\u003c 2.0.3.

GHSA-vwhg-jwr4-vxggHighCVSS 7.2

gettext.js has a Cross-site Scripting injection

Vendor

GitHub Security Advisories

Published

August 15, 2024

Last Modified

August 16, 2024

🔗 CVE IDs covered (1)

CVE-2024-43370 →

📋 Description

Impact

Possible vulnerability to XSS injection if .po dictionary definition files is corrupted

Patches

Update gettext.js to 2.0.3

Workarounds

Make sure you control the origin of the definition catalog to prevent the use of this flaw in the definition of plural forms.

🎯 Affected products1

npm/gettext.js:< 2.0.3

🔗 References (4)

https://github.com/guillaumepotier/gettext.js/security/advisories/GHSA-vwhg-jwr4-vxgg
https://nvd.nist.gov/vuln/detail/CVE-2024-43370
https://github.com/guillaumepotier/gettext.js/commit/8150aeba833183e14c2291a8a148b8f79d1d68d8
https://github.com/advisories/GHSA-vwhg-jwr4-vxgg