GHSA-7752-f4gf-94gc
Materialize-css vulnerable to Cross-site Scripting in autocomplete component
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | materialize-css | <= 1.0.0 | no fix listed |
| npm | @materializecss/materialize | < 1.1.0-alpha | 1.1.0-alpha |
Details
As written in the advisory (Markdown source, shown as plain text).
All versions of `materialize-css` are vulnerable to Cross-Site Scripting. The `autocomplete` component does not sufficiently sanitize user input, allowing an attacker to execute arbitrary JavaScript code if the malicious input is rendered by a user.
## Recommendation
No fix is currently available. Consider using an alternative module until a fix is made available.
References
External links from the advisory. They lead to third-party sites.