EUVD-2024-36332

Malicious code in bioql PyPI...

Cross Site Scripting (XSS)

survey-core is vulnerable to Cross Site Scripting XSS. The vulnerability is due to insufficient sanitization of the imageLink property in questionimage.ts, which allows an attacker to execute malicious scripts via setting contentMode=youtube...

CVE-2024-36043

questionimage.ts in SurveyJS Form Library before 1.10.4 allows contentMode=youtube XSS via the imageLink property...

CVE-2024-36043

questionimage.ts in SurveyJS Form Library before 1.10.4 allows contentMode=youtube XSS via the imageLink property...

CVE-2024-36043

The CVE-2024-36043 issue affects SurveyJS Form Library prior to 1.10.4, where question_image.ts allows a contentMode=youtube XSS through the imageLink property. The documented impact is Cross Site Scripting via imageLink, requiring contentMode=youtube to exploit. Mitigation: upgrade to version 1....