What is GHSA-whv6-rj84-2vh2?

GHSA-whv6-rj84-2vh2 is a security advisory published by GitHub Security Advisories with High severity. Cross-Site Scripting in nextcloud-vue-collections

Why does GHSA-whv6-rj84-2vh2 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-whv6-rj84-2vh2?

GHSA-whv6-rj84-2vh2 affects 1 product, including: npm/nextcloud-vue-collections:\u003c 0.4.2.

GHSA-whv6-rj84-2vh2HighDisclosed before NVD

Cross-Site Scripting in nextcloud-vue-collections

Vendor

GitHub Security Advisories

Published

September 4, 2020

Last Modified

January 9, 2023

📋 Description

Versions of nextcloud-vue-collections prior to 0.4.2 are vulnerable to Cross-Site Scripting (XSS). The v-tooltip component has an insecure defaultHTML configuration that allows arbitrary JavaScript to be injected in the tooltip of a collection item. This allows attackers to execute arbitrary code in a victim's browser.

Recommendation

Upgrade to version 0.4.2 or later.

🎯 Affected products1

npm/nextcloud-vue-collections:< 0.4.2

🔗 References (3)

https://github.com/juliushaertl/nextcloud-vue-collections/commit/8ec1fca214f003538cec4137792ede928f25f583
https://www.npmjs.com/advisories/1442
https://github.com/advisories/GHSA-whv6-rj84-2vh2