Malicious code in accretion-luna-materialize-process (npm)

The package accretion-luna-materialize-process was found to contain malicious code...

Malicious code in ganymede-sync-materialize-jabbah (npm)

The package ganymede-sync-materialize-jabbah was found to contain malicious code...

MAL-2025-33728 Malicious code in spectron-webdriver-materialize-string-planckscale (npm)

The package spectron-webdriver-materialize-string-planckscale was found to contain malicious code...

MAL-2025-13986 Malicious code in accretion-luna-materialize-process (npm)

The package accretion-luna-materialize-process was found to contain malicious code...

MAL-2025-40838 Malicious code in zenith-materialize-polaris-exobiology (npm)

The package zenith-materialize-polaris-exobiology was found to contain malicious code...

MAL-2025-17466 Malicious code in concurrently-local-antares-materialize (npm)

The package concurrently-local-antares-materialize was found to contain malicious code...

MAL-2025-25999 Malicious code in materialize-archaeoastronomy-io-test (npm)

The package materialize-archaeoastronomy-io-test was found to contain malicious code...

CVE-2019-11002

In Materialize through 1.0.0, XSS is possible via the Tooltip feature...

Cross-site Scripting (XSS)

materialize-css is vulnerable to cross-site scripting. The highlight function of autocomplete.js does not properly escape the user input such as , allowing an attacker to inject and execute malicious javascript...

materialize-css vulnerable to cross-site Scripting (XSS) due to improper escape of user input

All versions of package materialize-css are vulnerable to Cross-site Scripting XSS due to improper escape of user input such as not-a-tag / that is being parsed as HTML/JavaScript, and inserted into the Document Object Model DOM. This vulnerability can be exploited when the user-input is provided...

GHSA-7JVX-F994-RFW2 materialize-css vulnerable to cross-site Scripting (XSS) due to improper escape of user input

All versions of package materialize-css are vulnerable to Cross-site Scripting XSS due to improper escape of user input such as not-a-tag / that is being parsed as HTML/JavaScript, and inserted into the Document Object Model DOM. This vulnerability can be exploited when the user-input is provided...

CVE-2022-25349

All versions of package materialize-css are vulnerable to Cross-site Scripting XSS due to improper escape of user input such as not-a-tag / that is being parsed as HTML/JavaScript, and inserted into the Document Object Model DOM. This vulnerability can be exploited when the user-input is provided...

CVE-2022-25349

All versions of package materialize-css are vulnerable to Cross-site Scripting XSS due to improper escape of user input such as not-a-tag / that is being parsed as HTML/JavaScript, and inserted into the Document Object Model DOM. This vulnerability can be exploited when the user-input is provided...

Cross site scripting

All versions of package materialize-css are vulnerable to Cross-site Scripting XSS due to improper escape of user input such as not-a-tag / that is being parsed as HTML/JavaScript, and inserted into the Document Object Model DOM. This vulnerability can be exploited when the user-input is provided...

CVE-2022-25349

Removed by vendor...

CVE-2022-25349

CVE-2022-25349 affects materialize-css: XSS caused by improper escaping of user input in the autocomplete component, allowing input such as to be parsed as HTML/JavaScript and executed in the DOM. Connected sources (Veracode, OSV, SNYK) confirm all versions are vulnerable with the root cause in ...

CVE-2022-25349

All versions of package materialize-css are vulnerable to Cross-site Scripting XSS due to improper escape of user input such as not-a-tag / that is being parsed as HTML/JavaScript, and inserted into the Document Object Model DOM. This vulnerability can be exploited when the user-input is provided...

materialize-css 跨站脚本漏洞

materialize-css is a CSS framework based on Material Design. A security vulnerability exists in all versions of the materialize-css package that originates from user input being parsed as HTML/JavaScript and inserted into the Document Object Model DOM, which can be exploited by an attacker to...

5x5_uploader (>=1.0.0, <=1.2.2), @3t-transform/threeteeui (>=0.0.1, <=0.0.6) +250 more potentially affected by CVE-2022-25349 via materialize-css (>=0.96.1, <=1.0.0-rc.1)

materialize-css NPM version =0.96.1, =1.0.0, =0.0.1, =1.0.1, =1.0.3, =1.0.0, =6.1.3, =45.4.6, =0.0.3, =1.0.2, =0.0.4, =0.0.6, =1.0.0, =0.5.0, =0.7.0 and more Source cves: CVE-2022-25349 Source advisory: SNYK:JS-MATERIALIZECSS-2324800...

Cross-site Scripting (XSS)

Overview materialize-css is a CSS Framework based on Material Design. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper escape of user input such as not-a-tag / that is being parsed as HTML/JavaScript, and inserted into the Document Object Model DOM. Thi...