GHSA-vpch-rxw3-fgx8

Cross-Site Scripting in @risingstack/protect

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-1000160

Packages

Ecosystem	Package	Affected	Fixed in
npm	@risingstack/protect	<= 1.2.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

All versions of `@risingstack/protect` are vulnerable to Cross-Site Scripting. The `isXss()` XSS validator has several bypasses that may allow attackers to execute arbitrary JavaScript in a victim's browser. ## Recommendation No fix is currently available. Consider using an alternative package. The package is not actively maintained and will not be patched.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-1000160 advisory
https://github.com/RisingStack/protect/issues/16 web
https://github.com/RisingStack/protect package
https://github.com/RisingStack/protect/blob/60b0c91e86686d34e5202419ce9ae7e8dc08edcd/lib/rules/xss.js#L4-L13 web
https://github.com/advisories/GHSA-vpch-rxw3-fgx8 advisory
https://snyk.io/vuln/SNYK-JS-RISINGSTACKPROTECT-455402 web
https://www.npmjs.com/advisories/1116 web
http://embed.plnkr.co/xHbhB29JWWyMUMeHsLrm web