@candlelabs/sdk (>=1.0.1, <=1.0.2), candlelabssdk (1.0.0) potentially affected by CVE-2022-2218 via parse-url (6.0.0)

parse-url NPM version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on parse-url and may be impacted: - @candlelabs/sdk =1.0.1, =1.0.2 - candlelabssdk 1.0.0 Source cves: CVE-2022-2218 Source advisory: OSV:GHSA-JPP7-7CHH-CF67...

CVE-2022-2218

CVE-2022-2218 describes a stored XSS vulnerability in the parse-url library by ionicabizau, affecting versions prior to 7.0.0. The issue allows an attacker to place malicious JavaScript on a page via the vulnerable parse-url handling. The provided documents confirm the vulnerability but do not sp...