Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXBocGgteHBqNC13dmN2
Cross-Site Scripting in hexo-admin
All versions of hexo-admin
are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize rendered markdown, allowing attackers to execute arbitrary JavaScript in a victim's browser if they are able to create new posts.
Recommendation
No fix is currently available. Consider using an alternative package until a fix is made available.
Permalink: https://github.com/advisories/GHSA-phph-xpj4-wvcvJSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXBocGgteHBqNC13dmN2
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 4 years ago
Updated: over 1 year ago
Identifiers: GHSA-phph-xpj4-wvcv
References:
- https://github.com/jaredly/hexo-admin/issues/185
- https://www.npmjs.com/advisories/1211
- https://github.com/advisories/GHSA-phph-xpj4-wvcv
Blast Radius: 0.0
Affected Packages
npm:hexo-admin
Dependent packages: 4Dependent repositories: 499
Downloads: 1,699 last month
Affected Version Ranges: >= 0.0.0
No known fixed version
All affected versions: 0.1.2, 0.1.3, 0.2.0, 0.3.0, 1.0.0, 1.1.0, 1.1.1, 1.1.2, 2.0.0, 2.0.1, 2.1.0, 2.2.0, 2.2.1, 2.3.0