Path traversal in unjs/storage leads to code injection due to unsanitzed code generation

Path Traversal A path traversal vulnerability exists within unjs/unstorage when using the file system storage driver. This vulnerability can be exploited when the user has control over the key name. By creating key names containing sequences of ../ or ..: we can navigate the file system. We are...

norska (>=0.7.0, <=0.8.4), norska-frontend (>=0.7.4, <=0.9.11) +5 more potentially affected by CVE-2020-7642 via lazysizes (>=5.1.1, <=5.2.0)

lazysizes NPM version =5.1.1, =0.7.0, =0.7.4, =0.7.4, =2.1.4, =0.5.2, =0.5.2, =0.7.2 - sov 0.2.4 Source cves: CVE-2020-7642 Source advisory: OSV:GHSA-HG2P-2CVQ-4PPV...

norska (>=0.7.0, <=0.8.4), norska-frontend (>=0.7.4, <=0.9.11) +5 more potentially affected by unknown CVE via lazysizes (>=5.1.1, <=5.2.0)

lazysizes NPM version =5.1.1, =0.7.0, =0.7.4, =0.7.4, =2.1.4, =0.5.2, =0.5.2, =0.7.2 - sov 0.2.4 Source cves: unknown CVE Source advisory: OSV:GHSA-W4VP-3MQ7-7V82...

Cross-Site Scripting in @nuxt/devalue

Versions of @nuxt/devalue prior to 1.2.3 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization attacker may inject arbitrary JavaScript code through object keys. Recommendation Upgrade to version 1.2.3 or later...

CVE-2019-13506

@nuxt/devalue before 1.2.3, as used in Nuxt.js before 2.6.2, mishandles object keys, leading to XSS...

CVE-2019-13506

CVE-2019-13506 affects @nuxt/devalue before 1.2.3 (used in Nuxt.js before 2.6.2). The root cause is mishandling of object keys, leading to Cross-Site Scripting (XSS). Impact: potential XSS via object keys in affected builds; CVSS ~6.1 (NVD v3). Mitigation: upgrade to @nuxt/devalue 1.2.3 or later ...

PT-2019-13374

Name of the Vulnerable Software and Affected Versions @Nuxt/devalue versions prior to 1.2.3 Nuxt.js versions prior to 2.6.2 Description The issue is related to the mishandling of object keys, leading to Cross-Site Scripting XSS. Insufficient input sanitization allows an attacker to inject arbitra...

CVE-2019-13506: Improper Neutralization of Input During Web Page Generation

@nuxt/devalue before 1.2.3, as used in Nuxt.js before 2.6.2, mishandles object keys, leading to XSS...

Cross-site Scripting (XSS)

vuex-router-sync is vulnerable to cross-site scripting XSS attacks. The route parameter used in the server-rendered store in Nuxt render:routeContext hook are not sanitized, allowing an attacker to insert arbitrary Javascript...

Cross-Site Scripting

Overview Versions of @nuxt/devalue prior to 1.2.3 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization attacker may inject arbitrary JavaScript code through object keys. Recommendation Upgrade to version 1.2.3 or later. References - GitHub Issue - GitHub Advisory...