GHSA-w4v7-hwx7-9929

Cross-site Scripting in tempura

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-23784

Packages

Ecosystem	Package	Affected	Fixed in
npm	tempura	< 0.4.0	0.4.0

Details

As written in the advisory (Markdown source, shown as plain text).

This affects the package tempura before 0.4.0. If the input to the esc function is of type object (i.e an array) it is returned without being escaped/sanitized, leading to a potential Cross-Site Scripting vulnerability.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-23784 advisory
https://github.com/lukeed/tempura/commit/58a5c3671e2f36b26810e77ead9e0dd471902f9b web
https://github.com/lukeed/tempura package
https://github.com/lukeed/tempura/releases/tag/v0.4.0 web
https://snyk.io/vuln/SNYK-JS-TEMPURA-1569633 web