GHSA-rv8p-rr2h-fgpg
@apollo/experimental-nextjs-app-support Cross-site Scripting vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @apollo/experimental-nextjs-app-support | < 0.7.0 | 0.7.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
The @apollo/experimental-apollo-client-nextjs NPM package is vulnerable to a cross-site scripting vulnerability. This vulnerability arises from improper handling of untrusted input when @apollo/experimental-apollo-client-nextjs performs server-side rendering of HTML pages. To fix this vulnerability, we implemented appropriate escaping to prevent javascript injection into rendered pages.
### Patches
To fix this issue, please update to version 0.7.0 or later.
### Workarounds
There are no known workarounds for this issue. Please update to version 0.7.0
References
External links from the advisory. They lead to third-party sites.