Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS1mMzRtLXg5cGotNjJ2cc0YQQ

Cross-Site Scripting Vulnerability in @joeattardi/emoji-button

Impact

There are two vectors for XSS attacks with versions of @joeattardi/emoji-button before 4.6.2:

In both of these cases, a value can be crafted such that it can insert a script tag into the page and execute malicious code.

Patches

This vulnerability is fixed starting in version 4.6.2. This is resolved by properly escaping strings that are inserted into the HTML document.

Workarounds

There is no workaround other than upgrading to a non-vulnerable version.

Credit

This issue was discovered by GitHub team member @erik-krogh (Erik Krogh Kristensen) and was reported by the GitHub Security Lab team.

Permalink: https://github.com/advisories/GHSA-f34m-x9pj-62vq
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1mMzRtLXg5cGotNjJ2cc0YQQ
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 2 years ago
Updated: over 1 year ago


CVSS Score: 7.6
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

Identifiers: GHSA-f34m-x9pj-62vq, CVE-2021-43785
References: Repository: https://github.com/joeattardi/emoji-button
Blast Radius: 20.3

Affected Packages

npm:@joeattardi/emoji-button
Dependent packages: 38
Dependent repositories: 469
Downloads: 54,904 last month
Affected Version Ranges: < 4.6.2
Fixed in: 4.6.2
All affected versions: 2.2.4, 2.2.5, 2.2.6, 2.3.0, 2.4.0, 2.5.2, 2.5.3, 2.5.4, 2.6.0, 2.6.1, 2.7.0, 2.7.1, 2.7.2, 2.7.3, 2.8.0, 2.8.2, 2.8.3, 2.9.0, 2.9.1, 2.9.2, 2.9.4, 2.10.0, 2.11.0, 2.11.1, 2.12.0, 2.12.1, 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.1.1, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0, 4.5.1, 4.6.0, 4.6.1
All unaffected versions: 4.6.2, 4.6.4