GHSA-jp6r-xcjj-5h7r

Suggest an improvement
Source
https://github.com/advisories/GHSA-jp6r-xcjj-5h7r
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/08/GHSA-jp6r-xcjj-5h7r/GHSA-jp6r-xcjj-5h7r.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-jp6r-xcjj-5h7r
Aliases
Published
2019-08-27T17:36:32Z
Modified
2023-11-01T04:50:31.692760Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Cross-Site Scripting in cyberchef
Details

Versions of cyberchef prior to 8.31.3 are vulnerable to Cross-Site Scripting. In Text Encoding Brute Force the table rows are created by concatenating the value variable unsanitized in the HTML code. If this variable is controlled by user input it allows attackers to execute arbitrary JavaScript in a victim's browser.

Recommendation

Upgrade to version 8.31.3 or later.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "nvd_published_at": null,
    "github_reviewed": true,
    "severity": "MODERATE",
    "github_reviewed_at": "2019-08-27T15:50:14Z"
}
References

Affected packages

npm / cyberchef

Package

Name
cyberchef
View open source insights on deps.dev
Purl
pkg:npm/cyberchef

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
8.31.3