GHSA-cm5g-3pgc-8rg4
Express ressource injection
Packages
Details
As written in the advisory (Markdown source, shown as plain text).
A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used.
The issue arises from improper sanitization in `Link` header values, which can allow a combination of characters like `,`, `;`, and `<>` to preload malicious resources.
This vulnerability is especially relevant for dynamic parameters.
References
External links from the advisory. They lead to third-party sites.