Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWpwNnIteGNqai01aDdy
Cross-Site Scripting in cyberchef
Versions of cyberchef prior to 8.31.3 are vulnerable to Cross-Site Scripting. In Text Encoding Brute Force the table rows are created by concatenating the value variable unsanitized in the HTML code. If this variable is controlled by user input it allows attackers to execute arbitrary JavaScript in a victim's browser.
Recommendation
Upgrade to version 8.31.3 or later.
Permalink: https://github.com/advisories/GHSA-jp6r-xcjj-5h7rJSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWpwNnIteGNqai01aDdy
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 5 years ago
Updated: almost 2 years ago
CVSS Score: 6.1
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS Percentage: 0.00102
EPSS Percentile: 0.42574
Identifiers: GHSA-jp6r-xcjj-5h7r, CVE-2019-15532
References:
- https://nvd.nist.gov/vuln/detail/CVE-2019-15532
- https://github.com/gchq/CyberChef/commit/01f0625d6a177f9c5df9281f12a27c814c2d8bcf
- https://github.com/gchq/CyberChef/compare/v8.31.1...v8.31.2
- https://github.com/gchq/CyberChef/issues/539
- https://github.com/gchq/CyberChef/issues/544
- https://snyk.io/vuln/SNYK-JS-CYBERCHEF-460296
- https://www.npmjs.com/advisories/1149
- https://github.com/advisories/GHSA-jp6r-xcjj-5h7r
Blast Radius: 6.6
Affected Packages
npm:cyberchef
Dependent packages: 4Dependent repositories: 12
Downloads: 1,840 last month
Affected Version Ranges: < 8.31.3
Fixed in: 8.31.3
All affected versions: 4.0.0, 5.2.3, 5.2.4, 5.3.0, 5.3.1, 5.3.2, 5.3.3, 5.3.4, 5.3.5, 5.4.0, 5.4.1, 5.5.0, 5.6.0, 5.7.0, 5.7.1, 5.7.2, 5.7.3, 5.8.0, 5.9.0, 5.9.1, 5.9.2, 5.10.0, 5.10.1, 5.10.2, 5.10.3, 5.10.4, 5.10.5, 5.10.6, 5.10.7, 5.11.0, 5.11.1, 5.11.2, 5.11.3, 5.11.4, 5.11.5, 5.11.6, 5.11.7, 5.12.0, 5.12.1, 5.12.2, 5.12.3, 5.12.4, 5.13.0, 5.13.1, 5.14.0, 5.15.0, 5.16.0, 5.16.1, 5.16.2, 5.16.3, 5.17.0, 5.19.3, 5.20.0, 6.0.0, 6.0.1, 6.0.2, 6.1.0, 6.2.0, 6.2.1, 6.3.0, 6.3.1, 6.3.2, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.5.0, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.7.0, 6.7.1, 6.7.2, 6.8.0, 7.0.0, 7.1.0, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.3.0, 7.4.0, 7.5.0, 7.5.1, 7.5.2, 7.5.3, 7.5.4, 7.5.5, 7.5.6, 7.6.0, 7.6.1, 7.6.2, 7.6.3, 7.7.0, 7.7.1, 7.7.2, 7.7.3, 7.7.4, 7.7.5, 7.7.6, 7.7.7, 7.7.8, 7.8.0, 7.8.1, 7.9.0, 7.10.0, 7.10.1, 7.10.2, 7.10.3, 7.11.0, 7.11.1, 8.8.0, 8.8.1, 8.8.2, 8.8.4, 8.8.5, 8.8.6, 8.8.7, 8.8.8, 8.9.0, 8.9.1, 8.9.2, 8.10.0, 8.10.1, 8.10.2, 8.11.1, 8.11.2, 8.12.0, 8.12.1, 8.12.2, 8.12.3, 8.12.4, 8.13.0, 8.14.0, 8.15.0, 8.15.1, 8.16.0, 8.16.1, 8.17.0, 8.17.2, 8.18.0, 8.18.1, 8.19.0, 8.19.5, 8.19.6, 8.19.7, 8.20.0, 8.21.0, 8.22.0, 8.22.1, 8.23.0, 8.23.1, 8.23.2, 8.23.3, 8.23.4, 8.24.0, 8.24.1, 8.24.2, 8.24.3, 8.25.0, 8.26.0, 8.26.1, 8.26.2, 8.26.3, 8.27.0, 8.27.1, 8.27.2, 8.28.0, 8.29.0, 8.29.1, 8.30.0, 8.30.1, 8.31.0, 8.31.1
All unaffected versions: 8.31.3, 8.31.4, 8.31.5, 8.31.6, 8.31.7, 8.31.8, 8.32.0, 8.32.1, 8.33.0, 8.33.1, 8.34.0, 8.34.1, 8.34.2, 8.34.3, 8.35.0, 8.36.0, 8.36.1, 8.37.0, 8.38.0, 8.38.1, 8.38.2, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10, 9.1.0, 9.2.0, 9.2.1, 9.2.3, 9.3.0, 9.4.0, 9.4.1, 9.5.0, 9.6.0, 9.7.0, 9.7.1, 9.7.2, 9.7.3, 9.7.4, 9.7.6, 9.7.7, 9.7.8, 9.7.9, 9.7.10, 9.7.11, 9.7.12, 9.7.13, 9.7.14, 9.7.15, 9.7.16, 9.7.17, 9.7.18, 9.7.19, 9.7.20, 9.8.0, 9.9.0, 9.10.0, 9.11.0, 9.11.1, 9.11.2, 9.11.3, 9.11.4, 9.11.5, 9.11.6, 9.11.7, 9.11.8, 9.11.9, 9.11.10, 9.11.11, 9.11.12, 9.11.13, 9.11.14, 9.11.15, 9.11.16, 9.11.17, 9.11.19, 9.11.20, 9.12.0, 9.13.1, 9.13.2, 9.14.0, 9.15.0, 9.15.1, 9.16.0, 9.16.1, 9.16.2, 9.16.3, 9.16.4, 9.17.0, 9.18.0, 9.18.2, 9.19.0, 9.19.1, 9.20.2, 9.20.3, 9.20.4, 9.20.5, 9.20.6, 9.20.7, 9.21.0, 9.21.5, 9.21.6, 9.22.0, 9.22.1, 9.22.2, 9.22.3, 9.22.4, 9.23.0, 9.23.1, 9.24.0, 9.24.1, 9.24.2, 9.24.3, 9.24.5, 9.24.6, 9.24.7, 9.24.8, 9.25.0, 9.26.0, 9.26.1, 9.26.2, 9.26.3, 9.27.0, 9.27.1, 9.27.2, 9.27.4, 9.27.5, 9.27.6, 9.28.0, 9.30.0, 9.32.0, 9.32.1, 9.32.2, 9.32.3, 9.33.0, 9.33.1, 9.34.0, 9.34.1, 9.34.2, 9.35.0, 9.36.0, 9.36.1, 9.37.0, 9.37.1, 9.37.2, 9.37.3, 9.38.0, 9.38.1, 9.38.2, 9.38.4, 9.38.5, 9.38.6, 9.38.7, 9.38.8, 9.38.9, 9.39.0, 9.39.1, 9.39.2, 9.39.3, 9.39.4, 9.39.5, 9.39.6, 9.40.0, 9.41.0, 9.42.0, 9.43.0, 9.44.0, 9.45.0, 9.46.0, 9.46.1, 9.46.2, 9.46.3, 9.46.4, 9.46.5, 9.46.6, 9.46.7, 9.47.0, 9.47.1, 9.47.2, 9.47.3, 9.47.4, 9.47.5, 9.48.0, 9.49.0, 9.49.1, 9.49.2, 9.50.0, 9.50.1, 9.50.2, 9.50.3, 9.50.4, 9.50.5, 9.50.6, 9.50.7, 9.50.8, 9.50.9, 9.50.10, 9.50.11, 9.50.12, 9.52.0, 9.52.1, 9.53.0, 9.54.0, 9.55.0, 10.0.0, 10.0.1, 10.1.0, 10.2.0, 10.3.0, 10.4.0, 10.5.2, 10.6.0, 10.7.0, 10.8.0, 10.8.2, 10.9.0, 10.10.0, 10.13.0, 10.14.0, 10.15.0, 10.15.1, 10.16.0, 10.17.0, 10.18.3, 10.18.5, 10.18.6, 10.18.8, 10.18.9, 10.19.0, 10.19.2, 10.19.4