GHSA-rjvg-8v36-xv9r

element-plus vulnerable to cross-site scripting (XSS) via el-table-column

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-27103

Packages

Ecosystem	Package	Affected	Fixed in
npm	element-plus	< 2.0.6	2.0.6

Details

As written in the advisory (Markdown source, shown as plain text).

element-plus below 2.0.5 is vulnerable to Cross Site Scripting (XSS) when attribute `show-tooltips-overflow` of `el-table-column` is true. The mouseover action will make the text of this column render as html.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-27103 advisory
https://github.com/asjdf/element-table-xss-test/issues/1 web
https://github.com/element-plus/element-plus/issues/6514 web
https://github.com/element-plus/element-plus/pull/6520 web
https://github.com/element-plus/element-plus/commit/063c56446135176971f532bd0eb2e88a0b137d43 web
https://github.com/asjdf/element-table-xss-test web
https://github.com/element-plus/element-plus package