Description

WebTorrent before 0.107.6 allows XSS in the HTTP server via a title or file name.

Remediation

References

https://github.com/webtorrent/webtorrent/compare/v0.107.5...v0.107.6

https://github.com/webtorrent/webtorrent/pull/1714

https://hackerone.com/reports/681617

Related Vulnerabilities

CVE-2020-15171 Vulnerability in maven package org.xwiki.platform:xwiki-platform-oldcore

CVE-2021-23820 Vulnerability in npm package json-pointer

CVE-2021-45458 Vulnerability in maven package org.apache.kylin:kylin-core-common

CVE-2023-42810 Vulnerability in npm package systeminformation

CVE-2018-3732 Vulnerability in npm package resolve-path

Severity

High

Classification

CWE-79 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Patch Third Party Advisory