Description
This affects all versions of package lightning-server. It is possible to inject malicious JavaScript code as part of a session controller.
Remediation
References
https://github.com/lightning-viz/lightning/blob/master/app/controllers/session.js
https://github.com/lightning-viz/lightning/blob/master/app/controllers/session.js%23L230
https://snyk.io/vuln/SNYK-JS-LIGHTNINGSERVER-1019381
Related Vulnerabilities
CVE-2022-0639 Vulnerability in npm package url-parse
CVE-2022-29546 Vulnerability in maven package net.sourceforge.htmlunit:neko-htmlunit
CVE-2023-32978 Vulnerability in maven package org.jenkins-ci.plugins:ldap
CVE-2017-16176 Vulnerability in npm package jansenstuffpleasework
CVE-2023-29205 Vulnerability in maven package org.xwiki.platform:xwiki-platform-rendering-xwiki