~ / search / GHSA-7jh9-6cpf-h4m7

GHSA-7jh9-6cpf-h4m7

XSS in hello.js

Source: GitHub Advisory Database (reviewed) Critical CVE-2020-7741

Packages

EcosystemPackageAffectedFixed in
npm hellojs < 1.18.6 1.18.6

Details

As written in the advisory (Markdown source, shown as plain text).

This affects the package hello.js before 1.18.6. The code get the param oauth_redirect from url and pass it to location.assign without any check and sanitisation. So we can simply pass some XSS payloads into the url param oauth_redirect, such as `javascript:alert(1)`.

References

External links from the advisory. They lead to third-party sites.