CVE-2021-21316

less-openui5 is an npm package which enables building OpenUI5 themes with Less.js. In less-openui5 before version 0.10., when processing theming resources i.e. .less files with less-openui5 that originate from an untrusted source, those resources might contain JavaScript code which will be execut...

CVE-2021-21316

CVE-2021-21316 affects the npm package less-openui5 (pre-0.10.0) and can allow arbitrary code execution during build when processing untrusted theming resources (*.less). The vulnerability arises from inline JavaScript evaluation in a forked Less.js v1.6.3 embedded by less-openui5, which is norma...

@sap/grunt-sapui5-bestpractice-build (>=1.3.17, <=1.4.11), @sap/grunt-sapui5-bestpractice-test (>=0.0.1, <=2.0.3) +19 more potentially affected by CVE-2021-21316 via less-openui5 (>=0.1.0, <=0.9.0)

less-openui5 NPM version =0.1.0, =1.3.17, =0.0.1, =1.0.2, =0.0.12, =0.0.8, =0.0.1, =0.1.0, =0.0.1, =0.1.1, =0.1.0, =1.0.42, =0.1.0, =0.1.0, =1.0.0-beta.1, =1.2.0 and more Source cves: CVE-2021-21316 Source advisory: MEND:CVE-2021-21316...