CVE-2020-7741

2020-10-0615:15:15

Google

osv.dev

6.1 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

55.1%

JSON

This affects the package hellojs before 1.18.6. The code get the param oauth_redirect from url and pass it to location.assign without any check and sanitisation. So we can simply pass some XSS payloads into the url param oauth_redirect, such as javascript:alert(1).

CPENameOperatorVersion
hello.jseq1.4
hello.jseq1.16.1
hello.jseq1.13.1
hello.jseq1.0.1
hello.jseq1.14.1
hello.jseq1.9.2
hello.jseq1.17.1
hello.jseq1.2.1
hello.jseq1.8.2
hello.jseq1.9.0

Name	Operator	Version
hello.js	eq	1.4
hello.js	eq	1.16.1
hello.js	eq	1.13.1
hello.js	eq	1.0.1
hello.js	eq	1.14.1
hello.js	eq	1.9.2
hello.js	eq	1.17.1
hello.js	eq	1.2.1
hello.js	eq	1.8.2
hello.js	eq	1.9.0