GHSA-r96p-v3cr-gfv8
Cross-site Scripting (XSS) in @scullyio/scully
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @scullyio/scully | < 1.0.9 | 1.0.9 |
| npm | @scullyio/ng-lib | < 1.0.1 | 1.0.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
This affects the package @scullyio/scully before 1.0.9. The transfer state is serialised with the JSON.stringify() function and then written into the HTML page.
References
External links from the advisory. They lead to third-party sites.