Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS1tdzZxLTk4bXAtZzhnOM0W5Q

Cross-site Scripting in bootstrap-table

This affects all versions of package bootstrap-table. A type confusion vulnerability can lead to a bypass of input sanitization when the input provided to the escapeHTML function is an array (instead of a string) even if the escape attribute is set.

Permalink: https://github.com/advisories/GHSA-mw6q-98mp-g8g8
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tdzZxLTk4bXAtZzhnOM0W5Q
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Low
Classification: General
Published: over 2 years ago
Updated: about 1 year ago


CVSS Score: 3.1
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Identifiers: GHSA-mw6q-98mp-g8g8, CVE-2021-23472
References: Repository: https://github.com/wenzhixin/bootstrap-table
Blast Radius: 9.5

Affected Packages

npm:bootstrap-table
Dependent packages: 45
Dependent repositories: 1,132
Downloads: 443,709 last month
Affected Version Ranges: <= 1.19.0
No known fixed version
All affected versions: 1.6.0, 1.8.1, 1.9.1, 1.10.1, 1.11.0, 1.11.1, 1.11.2, 1.12.0, 1.12.1, 1.12.2, 1.13.0, 1.13.1, 1.13.2, 1.13.3, 1.13.4, 1.13.5, 1.14.0, 1.14.1, 1.14.2, 1.15.2, 1.15.3, 1.15.4, 1.15.5, 1.16.0, 1.17.0, 1.17.1, 1.18.0, 1.18.1, 1.18.2, 1.18.3, 1.19.0