GHSA-633r-r4p8-pw3w

Cross site scripting in Metro UI

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-41376

Packages

Ecosystem	Package	Affected	Fixed in
npm	metro4	>= 4.4.0, <= 4.5.1	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Metro UI v4.4.0 to v4.5.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Javascript function. User input is not properly sanitized before rendering in the `textarea` component.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-41376 advisory
https://alicangonullu.org/konu/138 web
https://github.com/olton/Metro-UI-CSS package
https://youtu.be/_wzGVpX54Rc web