GHSA-2pwh-52h7-7j84
JavaScript execution via malicious molfiles (XSS)
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | de.ipb-halle:molecularfaces | < 0.3.0 | 0.3.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
The viewer plugin implementation of `<mol:molecule>` renders molfile data directly inside a `<script>` tag without any escaping. Arbitrary JavaScript code can thus be executed in the client browser via crafted molfiles.
### Patches
Patched in v0.3.0: Molfile data is now rendered as value of a hidden `<input>` tag and escaped via JSF's mechanisms.
### Workarounds
No workaround available.
References
External links from the advisory. They lead to third-party sites.