Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1xZm1yLTZxdmgtNDlnbc4AAuAE
XSS
Withdrawn: Duplicate of GHSA-vcjj-xf2r-mwvc.
Knockout, before 3.5.0-beta, has an XSS injection point in attr name binding for browser IE7 and older.
Permalink: https://github.com/advisories/GHSA-qfmr-6qvh-49gmJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xZm1yLTZxdmgtNDlnbc4AAuAE
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 3 years ago
Updated: over 1 year ago Widthdrawn: over 3 years ago
Identifiers: GHSA-qfmr-6qvh-49gm
References:
- https://github.com/knockout/knockout/issues/1244
- https://github.com/knockout/knockout/commit/86b06aa8633f9f72b953f512df7471a22689ea14
- https://github.com/advisories/GHSA-qfmr-6qvh-49gm
Blast Radius: 0.0
Affected Packages
npm:knockout
Dependent packages: 498Dependent repositories: 2,165
Downloads: 389,960 last month
Affected Version Ranges: < 3.5.0
Fixed in: 3.5.0
All affected versions: 2.1.0, 2.2.1, 2.3.0, 3.0.0, 3.1.0, 3.2.0, 3.3.0, 3.4.0, 3.4.1, 3.4.2
All unaffected versions: 3.5.0, 3.5.1