GHSA-fvhg-p4hf-79x3
@cyntler/react-doc-viewer's TXTRenderer fails to sanitize file content and explicitly casts raw data as a ReactNode
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @cyntler/react-doc-viewer | <= 1.17.1 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
Cross-Site Scripting (XSS) vulnerability in @cyntler/react-doc-viewer v1.17.1 allows remote attackers to execute arbitrary JavaScript via a crafted .txt file. The TXTRenderer component fails to sanitize file content and explicitly casts raw data as a ReactNode.
References
External links from the advisory. They lead to third-party sites.