~ / search / GHSA-jp6r-xcjj-5h7r

GHSA-jp6r-xcjj-5h7r

Cross-Site Scripting in cyberchef

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-15532

Packages

EcosystemPackageAffectedFixed in
npm cyberchef < 8.31.3 8.31.3

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of `cyberchef` prior to 8.31.3 are vulnerable to Cross-Site Scripting. In `Text Encoding Brute Force` the table rows are created by concatenating the `value` variable unsanitized in the HTML code. If this variable is controlled by user input it allows attackers to execute arbitrary JavaScript in a victim's browser. ## Recommendation Upgrade to version 8.31.3 or later.

References

External links from the advisory. They lead to third-party sites.