Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTg3bWctaDVyMy1odzg4

Cross-Site Scripting in bootbox

All version of bootbox are vulnerable to Cross-Site Scripting. The package does not sanitize user input in the provided dialog boxes, allowing attackers to inject HTML code and execute arbitrary JavaScript.

Recommendation

Sanitize user input being passed to bootbox or consider using an alternative package.

Permalink: https://github.com/advisories/GHSA-87mg-h5r3-hw88
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTg3bWctaDVyMy1odzg4
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 5 years ago
Updated: over 1 year ago

Identifiers: GHSA-87mg-h5r3-hw88
References:

• https://github.com/makeusabrew/bootbox/issues/661
• https://hackerone.com/reports/508446
• https://www.npmjs.com/advisories/882
• https://github.com/advisories/GHSA-87mg-h5r3-hw88

Repository: https://github.com/makeusabrew/bootbox
Blast Radius: 0.0

Affected Packages