GHSA-jhgf-2h8h-ggxv
Parse Server has a Cross-Site Scripting (XSS) vulnerability via Unescaped Mustache Template Variables
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | parse-server | < 8.6.1 | 8.6.1 |
| npm | parse-server | >= 9.0.0, < 9.1.0-alpha.3 | 9.1.0-alpha.3 |
Details
As written in the advisory (Markdown source, shown as plain text).
## Impact
A Reflected Cross-Site Scripting (XSS) vulnerability exists in Parse Server's password reset and email verification HTML pages.
## Patches
The patch escapes user controlled values that are inserted into the HTML pages.
## Workarounds
None.
## Resources
- https://github.com/parse-community/parse-server/security/advisories/GHSA-jhgf-2h8h-ggxv
- https://github.com/parse-community/parse-server/pull/9985
- https://github.com/parse-community/parse-server/pull/9986
References
External links from the advisory. They lead to third-party sites.