@2dine/framework-ui (>=1.0.4, <=2.1.91), @gesdisc/components (>=1.0.0, <=1.0.74) +20 more potentially affected by CVE-2022-25854 via @yaireo/tagify (>=2.31.6, <=3.25.0)

@yaireo/tagify NPM version =2.31.6, =1.0.4, =1.0.0, =1.0.8, =0.0.1-dev.0, =1.0.97, =1.0.0, =0.22.0, =1.3.0, =0.0.1, =0.0.2, =0.9.0, =0.0.1, =0.3.0, =0.6.0 and more Source cves: CVE-2022-25854 Source advisory: MEND:CVE-2022-25854...

CVE-2022-25854

This affects the package @yaireo/tagify before 4.9.8. The package is used for rendering UI components inside the input or text fields, and an attacker can pass a malicious placeholder value to it to fire the XSS payload...

CVE-2022-25854 Cross-site Scripting (XSS)

This affects the package @yaireo/tagify before 4.9.8. The package is used for rendering UI components inside the input or text fields, and an attacker can pass a malicious placeholder value to it to fire the XSS payload...

CVE-2022-25854: Improper Neutralization of Input During Web Page Generation

This affects the package @yaireo/tagify before 4.9.8. The package is used for rendering UI components inside the input or text fields, and an attacker can pass a malicious placeholder value to it to fire the XSS payload...

PT-2022-17570 · Npm · @Yaireo/Tagify

Name of the Vulnerable Software and Affected Versions: @yaireo/tagify versions prior to 4.9.8 Description: The issue affects the package used for rendering UI components inside input or text fields. An attacker can pass a malicious placeholder value to fire the cross-site scripting XSS payload...