Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS1tMmhtLWhycjItNnAycc4AAq8b

Cross-site Scripting in Bootstrap-3-Typeahead

Bootstrap-3-Typeahead after version 4.0.2 is vulnerable to a cross-site scripting flaw in the highlighter() function. An attacker could exploit this via user interaction to execute code in the user's browser. This issue was introduced in commit dbd1af5bf and has not been fixed.

Permalink: https://github.com/advisories/GHSA-m2hm-hrr2-6p2q
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tMmhtLWhycjItNnAycc4AAq8b
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: about 1 year ago


CVSS Score: 6.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Identifiers: GHSA-m2hm-hrr2-6p2q, CVE-2019-10215
References: Repository: https://github.com/bassjobsen/Bootstrap-3-Typeahead
Blast Radius: 25.0

Affected Packages

packagist:bassjobsen/bootstrap-3-typeahead
Dependent packages: 4
Dependent repositories: 13
Downloads: 252,621 total
Affected Version Ranges: > 4.0.2
No known fixed version
All affected versions:
npm:bootstrap-3-typeahead
Dependent packages: 8
Dependent repositories: 951
Downloads: 66,891 last month
Affected Version Ranges: > 4.0.2
No known fixed version
All affected versions: