Lucene search
GoogleOSV:GHSA-PXPF-V376-7XX5HistoryApr 30, 2022 - 12:00 a.m.
tagify can pass a malicious placeholder to initiate the cross-site scripting (XSS) payload
2022-04-3000:00:33
Google
osv.dev
7
0.001 Low
EPSS
Percentile
43.9%
This affects the package @yaireo/tagify before 4.9.8. The package is used for rendering UI components inside the input or text fields, and an attacker can pass a malicious placeholder value to it to fire the cross-site scripting (XSS) payload.
| CPE | Name | Operator | Version |
|---|---|---|---|
| @yaireo/tagify | lt | 4.9.8 |
References
bsg.tech/blog/cve-2022-25854-stored-xss-in-yaireo-tagify-npm-module
github.com/yairEO/tagify
github.com/yairEO/tagify/commit/198c0451fad188390390395ccfc84ab371def4c7
github.com/yairEO/tagify/issues/988
github.com/yairEO/tagify/releases/tag/v4.9.8
nvd.nist.gov/vuln/detail/CVE-2022-25854
snyk.io/vuln/SNYK-JS-YAIREOTAGIFY-2404358
Related
cvelist
cvelist
CVE-2022-25854 Cross-site Scripting (XSS)
2022-04-29 00:00:00
nvd
nvd
CVE-2022-25854
2022-04-29 20:15:07
cve
cve
CVE-2022-25854
2022-04-29 20:15:07
github
github
veracode
veracode
Cross-Site Scripting (XSS)
2022-05-04 13:01:43
prion
prion
Cross site scripting
2022-04-29 20:15:00
osv
osv
CVE-2022-25854
2022-04-29 20:15:07