GHSA-6rjc-4pwr-3vp7
Cross-Site Scripting in iobroker.web
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | iobroker.web | < 2.4.10 | 2.4.10 |
Details
As written in the advisory (Markdown source, shown as plain text).
Versions of `iobroker.web` prior to 2.4.10 are vulnerable to Cross-Site Scripting. The package fails to escape URL parameters that may be reflected in the server response. This can be used by attackers to execute arbitrary JavaScript in the victim's browser.
## Recommendation
Upgrade to version 2.4.10 or later.
References
External links from the advisory. They lead to third-party sites.