GHSA-rg3q-jxmp-pvjj
Materialize-css vulnerable to Improper Neutralization of Input During Web Page Generation
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | materialize-css | <= 1.0.0 | no fix listed |
| npm | @materializecss/materialize | < 1.1.0-alpha | 1.1.0-alpha |
Details
As written in the advisory (Markdown source, shown as plain text).
In Materialize through 1.0.0, XSS is possible via the Toast feature.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2019-11004
- https://github.com/Dogfalo/materialize/issues/6286
- https://github.com/Dogfalo/materialize/issues/6331#issuecomment-549080183
- https://github.com/materializecss/materialize/pull/49
- https://github.com/samschurter/materialize/commit/3aae4cc9bb2b58c337bf25d2f04f129a2a0fa78f
- https://github.com/Dogfalo/materialize
- https://github.com/advisories/GHSA-rg3q-jxmp-pvjj