Description

This affects all versions of package lightning-server. It is possible to inject malicious JavaScript code as part of a session controller.

Remediation

References

https://github.com/lightning-viz/lightning/blob/master/app/controllers/session.js

https://github.com/lightning-viz/lightning/blob/master/app/controllers/session.js%23L230

https://snyk.io/vuln/SNYK-JS-LIGHTNINGSERVER-1019381

Related Vulnerabilities

CVE-2023-31717 Vulnerability in npm package @frangoteam/fuxa

CVE-2021-42767 Vulnerability in maven package org.neo4j.procedure:apoc

CVE-2020-27885 Vulnerability in maven package org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.store.feature

CVE-2020-28453 Vulnerability in npm package npos-tesseract

CVE-2021-25916 Vulnerability in npm package patchmerge

Severity

Critical

Classification

CWE-79

Tags

Exploit Vendor Advisory Broken Link Third Party Advisory