Cross-Site Scripting in eco

2020-09-03T17:08:20
ID GHSA-R32X-JHW5-G48P
Type github
Reporter GitHub Advisory Database
Modified 2020-09-03T17:08:20

Description

All versions of eco are vulnerable to Cross-Site Scripting (XSS). The package's default __escape implementation fails to escape single quotes, which may allow attackers to execute arbitrary JavaScript on the victim's browser.

Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.