GHSA-rpmr-fwh5-24fm
TeamPass Cross-site Scripting (XSS) vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | nilsteampassnet/teampass | <= 2.1.27.36 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
TeamPass 2.1.27.36 allows XSS by setting a crafted password for an item in a folder, and then sharing that item with an admin. (The crafted password is exploitable when viewing the change history, or the previous used password field.)
References
External links from the advisory. They lead to third-party sites.