~ / search / GHSA-pxpf-v376-7xx5

GHSA-pxpf-v376-7xx5

tagify can pass a malicious placeholder to initiate the cross-site scripting (XSS) payload

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-25854

Packages

EcosystemPackageAffectedFixed in
npm @yaireo/tagify < 4.9.8 4.9.8

Details

As written in the advisory (Markdown source, shown as plain text).

This affects the package @yaireo/tagify before 4.9.8. The package is used for rendering UI components inside the input or text fields, and an attacker can pass a malicious placeholder value to it to fire the cross-site scripting (XSS) payload.

References

External links from the advisory. They lead to third-party sites.