Description

XSS exists in Shave before 2.5.3 because output encoding is mishandled during the overwrite of an HTML element.

Remediation

References

https://www.npmjs.com/advisories/822

https://github.com/dollarshaveclub/shave/compare/852b537...da7371b

https://github.com/dollarshaveclub/shave/commit/da7371b0531ba14eae48ef1bb1456a3de4cfa954#diff-074799b511e4b61923dfd3f2a3bf9b54R67

Related Vulnerabilities

CVE-2022-22984 Vulnerability in npm package snyk-docker-plugin

CVE-2020-11996 Vulnerability in maven package org.apache.tomcat:tomcat-coyote

CVE-2019-10796 Vulnerability in npm package rpi

CVE-2023-24057 Vulnerability in maven package ca.uhn.hapi.fhir:org.hl7.fhir.r4b

CVE-2020-26291 Vulnerability in npm package urijs

Severity

High

Classification

CWE-79 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Third Party Advisory Patch