GHSA-8cpw-73f2-w58m
Cross-Site Scripting in selectize-plugin-a11y
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | selectize-plugin-a11y | < 1.1.0 | 1.1.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
Versions of `selectize-plugin-a11y ` prior to 1.1.0 are vulnerable to Cross-Site Scripting. The `accessibility.liveRegion.speak` function does not sanitize the `msg` variable before rendering it as HTML. If this variable is controlled by user input it allows attackers to execute arbitrary JavaScript in a victim's browser.
## Recommendation
Upgrade to version 1.1.0 or later.
References
External links from the advisory. They lead to third-party sites.