GHSA-8775-5hwv-wr6v
Potential for cross-site scripting in PostHog-js
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | posthog-js | < 1.57.2 | 1.57.2 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Potential for cross-site scripting in `posthog-js`.
### Patches
The problem has been patched in `posthog-js` version 1.57.2.
### Workarounds
- This isn't an issue for sites that have a Content Security Policy in place.
- Using the HTML tracking snippet on PostHog Cloud always guarantees the latest version of the library – in that case no action is required to upgrade to the patched version.
### References
We will publish details of the vulnerability in 30 days as per our [security policy](https://posthog.com/handbook/company/security#policies).
References
External links from the advisory. They lead to third-party sites.