Description
XSS exists in Shave before 2.5.3 because output encoding is mishandled during the overwrite of an HTML element.
Remediation
References
https://www.npmjs.com/advisories/822
https://github.com/dollarshaveclub/shave/compare/852b537...da7371b
https://github.com/dollarshaveclub/shave/commit/da7371b0531ba14eae48ef1bb1456a3de4cfa954#diff-074799b511e4b61923dfd3f2a3bf9b54R67
Related Vulnerabilities
CVE-2017-8028 Vulnerability in maven package org.springframework.ldap:spring-ldap-core
CVE-2022-31142 Vulnerability in npm package @fastify/bearer-auth
CVE-2020-36518 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind
CVE-2020-2260 Vulnerability in maven package org.jenkins-ci.plugins:perfecto