Cross-Site Scripting

Overview

Affected versions of yui are vulnerable to cross-site scripting in the uploader.swf and io.swf utilities, via script injection in the url.

Recommendation

YUI has published their recommendation to fix this issue.
Their recommendation is to:

• Delete self-hosted copies of these files if you are not using them
• Use the Yahoo! CDN hosted files
• Use the patched files provided on the YUI Library here.

References

• YUI Security Bulletin
• GitHub Advisory