Description
This affects all versions of package lightning-server. It is possible to inject malicious JavaScript code as part of a session controller.
Remediation
References
https://github.com/lightning-viz/lightning/blob/master/app/controllers/session.js
https://github.com/lightning-viz/lightning/blob/master/app/controllers/session.js%23L230
https://snyk.io/vuln/SNYK-JS-LIGHTNINGSERVER-1019381
Related Vulnerabilities
CVE-2020-6428 Vulnerability in npm package electron
CVE-2021-29943 Vulnerability in maven package org.apache.solr:solr-core
CVE-2021-44906 Vulnerability in npm package minimist
CVE-2013-3300 Vulnerability in maven package net.liftweb:lift-json_2.9.1
CVE-2017-16083 Vulnerability in npm package node-simple-router