DocumentationSeverity
2.3
Low severity
Details
- CVSS score
- 2.3
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Overview
About vulnerability
serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped </script. Attackers controlling a function’s source via a spoofed toString() can combine surrounding output delimiters and later values to inject live markup such as img onerror handlers.Details
- Affected product:
- @content-collections/mdx , Vue , allure-codeceptjs , allure-mocha , analogjs-platform , analogjs-storybook-angular , analogjs-vite-plugin-angular , analogjs-vite-plugin-nitro , angular-devkit-build-angular , codeceptjs , content-collections-core , copy-webpack-plugin , css-minimizer-webpack-plugin , divebell , docusaurus , fumadocs-content-collections , lynx-js-config-rsbuild-plugin , lynx-js-genui , lynx-js-qrcode-rsbuild-plugin , lynx-js-react-alias-rsbuild-plugin , lynx-js-react-rsbuild-plugin , lynx-js-rsbuild-plugin , lynx-js-rspeedy , mocha , modern-js-adapter-rstest , modern-js-app-tools , modern-js-builder , modern-js-create-request , modern-js-plugin , modern-js-plugin-bff , modern-js-plugin-data-loader , modern-js-plugin-i18n , modern-js-plugin-ssg , modern-js-prod-server , modern-js-runtime , modern-js-runtime-utils , modern-js-server , modern-js-server-core , modern-js-server-runtime , nitro , nitroparty , nuxt , nuxt-devtools-ui-kit , nuxt-nitro-server , nuxt-rspack-builder , nuxt-vite-builder , nuxt-vite-server , nuxt-webpack-builder , nx , nx-next , nx-webpack , plugins , powersync-nuxt , rollup-plugin-workbox , rsbuild-plugin-css-minimizer , rushstack-module-minifier , rushstack-webpack4-module-minifier-plugin , rushstack-webpack5-module-minifier-plugin , sentry-nuxt , sentry-solidstart , serialize-javascript , size-limit-webpack-css , solidjs-start , storybook-angular , tldts-tests , uppy-companion , vinxi , vinxi-router , vinxi-server-components , vinxi-server-functions , wdio-browser-runner , wdio-mocha-framework , workbox , zephyr-modernjs-plugin , zephyr-nuxt-module
- Affected packages:
- @uppy/companion @ 7.0.3 (+607 more)