@argueta10/vue-webrtc (1.3.0), @hacksore/rtcmulticonnection (>=3.7.1, <=4.0.0-alpha1) +15 more potentially affected by unknown CVE via canvas-designer (1.3.0)

canvas-designer NPM version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on canvas-designer and may be impacted: - @argueta10/vue-webrtc 1.3.0 - @hacksore/rtcmulticonnection =3.7.1, =3.7.2, =1.3.6, =1.0.1, =0.1.0, =3.5.0, =0.0.1, =1.0.0, =0.1.0,...

Cross-site Scripting (XSS)

Overview canvas-designer is a JavaScript Canvas2D drawing tool, supporting dozens of builtin tools, as well as generates JavaScript code for 2D animations. Affected versions of this package are vulnerable to Cross-site Scripting XSS. It's possible to send malicious data to the message listener...