Malicious code in yildun-materialize-publish-cordelia (npm)

The package yildun-materialize-publish-cordelia was found to contain malicious code...

MAL-2025-26002 Malicious code in materialize-inflation-graviton-on (npm)

The package materialize-inflation-graviton-on was found to contain malicious code...

MAL-2025-26001 Malicious code in materialize-europa-forever-dependencies (npm)

The package materialize-europa-forever-dependencies was found to contain malicious code...

MAL-2025-40509 Malicious code in yildun-materialize-publish-cordelia (npm)

The package yildun-materialize-publish-cordelia was found to contain malicious code...

MAL-2025-33728 Malicious code in spectron-webdriver-materialize-string-planckscale (npm)

The package spectron-webdriver-materialize-string-planckscale was found to contain malicious code...

MAL-2025-17295 Malicious code in colors-materialize-astrochemistry-figures (npm)

The package colors-materialize-astrochemistry-figures was found to contain malicious code...

MAL-2025-26000 Malicious code in materialize-dendrochronology-atlas-technocracy (npm)

The package materialize-dendrochronology-atlas-technocracy was found to contain malicious code...

MAL-2025-25999 Malicious code in materialize-archaeoastronomy-io-test (npm)

The package materialize-archaeoastronomy-io-test was found to contain malicious code...

CVE-2019-11002

In Materialize through 1.0.0, XSS is possible via the Tooltip feature...

Cross-site Scripting (XSS)

materialize-css is vulnerable to cross-site scripting. The highlight function of autocomplete.js does not properly escape the user input such as , allowing an attacker to inject and execute malicious javascript...

GHSA-7JVX-F994-RFW2 materialize-css vulnerable to cross-site Scripting (XSS) due to improper escape of user input

All versions of package materialize-css are vulnerable to Cross-site Scripting XSS due to improper escape of user input such as not-a-tag / that is being parsed as HTML/JavaScript, and inserted into the Document Object Model DOM. This vulnerability can be exploited when the user-input is provided...

materialize-css vulnerable to cross-site Scripting (XSS) due to improper escape of user input

All versions of package materialize-css are vulnerable to Cross-site Scripting XSS due to improper escape of user input such as not-a-tag / that is being parsed as HTML/JavaScript, and inserted into the Document Object Model DOM. This vulnerability can be exploited when the user-input is provided...

CVE-2022-25349

All versions of package materialize-css are vulnerable to Cross-site Scripting XSS due to improper escape of user input such as not-a-tag / that is being parsed as HTML/JavaScript, and inserted into the Document Object Model DOM. This vulnerability can be exploited when the user-input is provided...

CVE-2022-25349

All versions of package materialize-css are vulnerable to Cross-site Scripting XSS due to improper escape of user input such as not-a-tag / that is being parsed as HTML/JavaScript, and inserted into the Document Object Model DOM. This vulnerability can be exploited when the user-input is provided...

Cross site scripting

All versions of package materialize-css are vulnerable to Cross-site Scripting XSS due to improper escape of user input such as not-a-tag / that is being parsed as HTML/JavaScript, and inserted into the Document Object Model DOM. This vulnerability can be exploited when the user-input is provided...

CVE-2022-25349

All versions of package materialize-css are vulnerable to Cross-site Scripting XSS due to improper escape of user input such as that is being parsed as HTML/JavaScript, and inserted into the Document Object Model DOM. This vulnerability can be exploited when the user-input is provided to the...

CVE-2022-25349

CVE-2022-25349 affects materialize-css: XSS caused by improper escaping of user input in the autocomplete component, allowing input such as to be parsed as HTML/JavaScript and executed in the DOM. Connected sources (Veracode, OSV, SNYK) confirm all versions are vulnerable with the root cause in ...

CVE-2022-25349

Removed by vendor...

CVE-2022-25349

All versions of package materialize-css are vulnerable to Cross-site Scripting XSS due to improper escape of user input such as not-a-tag / that is being parsed as HTML/JavaScript, and inserted into the Document Object Model DOM. This vulnerability can be exploited when the user-input is provided...

PT-2022-17230

Name of the Vulnerable Software and Affected Versions materialize-css versions all versions Description The issue arises from improper escape of user input, such as , which is then parsed as HTML/JavaScript and inserted into the Document Object Model DOM. This can lead to Cross-site Scripting XSS...