GHSA-vcjj-xf2r-mwvc

XSS in knockout

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-14862

Packages

Ecosystem	Package	Affected	Fixed in
npm	knockout	< 3.5.0	3.5.0

Details

As written in the advisory (Markdown source, shown as plain text).

There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-14862 advisory
https://github.com/knockout/knockout/issues/1244 web
https://github.com/knockout/knockout/pull/2345 web
https://github.com/knockout/knockout/commit/7e280b2b8a04cc19176b5171263a5c68bda98efb web
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14862 web
https://snyk.io/vuln/npm:knockout:20180213 web
https://www.oracle.com/security-alerts/cpuapr2022.html web
https://www.oracle.com/security-alerts/cpujan2021.html web
https://www.oracle.com/security-alerts/cpujul2020.html web
https://www.whitesourcesoftware.com/vulnerability-database/WS-2019-0015 web