Data

Tools

Indexes

Applications

Experiments

Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXIzMngtamh3NS1nNDhw

High
Permalink JSON

Cross-Site Scripting in eco

Affected Packages Affected Versions Fixed Versions
npm:eco >= 0.0.0 No known fixed version
200 Dependent packages
28,282 Dependent repositories
14,878 Downloads last month

Affected Version Ranges

All affected versions

1.0.0, 1.0.1, 1.0.2, 1.0.3

All versions of eco are vulnerable to Cross-Site Scripting (XSS). The package's default __escape implementation fails to escape single quotes, which may allow attackers to execute arbitrary JavaScript on the victim's browser.

Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

References:

Identifiers

GHSA-r32x-jhw5-g48p

Risk

Severity

High

Classification

General

Source

GitHub Advisory Database

Origin

Unspecified

Repository

https://github.com/sstephenson/eco

Date and time

Published

almost 5 years ago

Updated

over 2 years ago

API

JSON