Description

WebTorrent before 0.107.6 allows XSS in the HTTP server via a title or file name.

Remediation

References

https://github.com/webtorrent/webtorrent/compare/v0.107.5...v0.107.6

https://github.com/webtorrent/webtorrent/pull/1714

https://hackerone.com/reports/681617

Related Vulnerabilities

CVE-2020-11112 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind

CVE-2019-10793 Vulnerability in npm package dot-object

CVE-2022-2421 Vulnerability in npm package socket.io-parser

CVE-2021-21278 Vulnerability in npm package rsshub

CVE-2019-11082 Vulnerability in maven package de.tudarmstadt.ukp.dkpro.core:de.tudarmstadt.ukp.dkpro.core.api.datasets-asl

Severity

High

Classification

CWE-79 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Patch Third Party Advisory