GHSA-vqr3-vrrg-f3jh

NodeBB Cross-site scripting (XSS) vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-57041

Packages

Ecosystem	Package	Affected	Fixed in
npm	nodebb	< 3.11.1	3.11.1

Details

As written in the advisory (Markdown source, shown as plain text).

A persistent cross-site scripting (XSS) vulnerability in NodeBB v3.11.0 allows remote attackers to store arbitrary code in the 'about me' section of their profile.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-57041 advisory
https://github.com/NodeBB/NodeBB/commit/4e69bff72fd04779064d37e46a43080e6c328adf web
https://github.com/NodeBB/NodeBB package
https://www.tonysec.com/posts/cve-2024-57041 web