~ / search / GHSA-pp7m-6j83-m7r6

GHSA-pp7m-6j83-m7r6

Cross-site Scripting in video.js

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-23414

Packages

EcosystemPackageAffectedFixed in
npm video.js < 7.14.3 7.14.3

Details

As written in the advisory (Markdown source, shown as plain text).

This affects the package video.js before 7.14.3. The src attribute of track tag allows to bypass HTML escaping and execute arbitrary code.

References

External links from the advisory. They lead to third-party sites.