Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1mMzRtLXg5cGotNjJ2cc0YQQ
Cross-Site Scripting Vulnerability in @joeattardi/emoji-button
Impact
There are two vectors for XSS attacks with versions of @joeattardi/emoji-button before 4.6.2:
- A URL for a custom emoji
- An i18n string
In both of these cases, a value can be crafted such that it can insert a script
tag into the page and execute malicious code.
Patches
This vulnerability is fixed starting in version 4.6.2. This is resolved by properly escaping strings that are inserted into the HTML document.
Workarounds
There is no workaround other than upgrading to a non-vulnerable version.
Credit
This issue was discovered by GitHub team member @erik-krogh (Erik Krogh Kristensen) and was reported by the GitHub Security Lab team.
Permalink: https://github.com/advisories/GHSA-f34m-x9pj-62vqJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1mMzRtLXg5cGotNjJ2cc0YQQ
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 2 years ago
Updated: over 1 year ago
CVSS Score: 7.6
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
Identifiers: GHSA-f34m-x9pj-62vq, CVE-2021-43785
References:
- https://github.com/joeattardi/emoji-button/security/advisories/GHSA-f34m-x9pj-62vq
- https://nvd.nist.gov/vuln/detail/CVE-2021-43785
- https://github.com/joeattardi/emoji-button/commit/05970c09180cd27fff493e998ac5bf0468b1bb16
- https://github.com/joeattardi/emoji-button/commit/fe54bef107eb3f74873a4018f2ff49fa124c6a2e
- https://github.com/advisories/GHSA-f34m-x9pj-62vq
Blast Radius: 20.3
Affected Packages
npm:@joeattardi/emoji-button
Dependent packages: 38Dependent repositories: 469
Downloads: 54,904 last month
Affected Version Ranges: < 4.6.2
Fixed in: 4.6.2
All affected versions: 2.2.4, 2.2.5, 2.2.6, 2.3.0, 2.4.0, 2.5.2, 2.5.3, 2.5.4, 2.6.0, 2.6.1, 2.7.0, 2.7.1, 2.7.2, 2.7.3, 2.8.0, 2.8.2, 2.8.3, 2.9.0, 2.9.1, 2.9.2, 2.9.4, 2.10.0, 2.11.0, 2.11.1, 2.12.0, 2.12.1, 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.1.1, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0, 4.5.1, 4.6.0, 4.6.1
All unaffected versions: 4.6.2, 4.6.4