@antlerengineering/components (>=2.4.0, <=2.10.3), @antlerengineering/form-builder (>=2.1.7, <=2.4.1) +42 more potentially affected by CVE-2021-23411 via anchorme (2.1.2)

anchorme NPM version 2.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on anchorme and may be impacted: - @antlerengineering/components =2.4.0, =2.1.7, =2.10.4, =0.0.1, =2.1.0-rc1, =0.0.1, =0.6.6, =1.1.12, =1.2.7, =1.0.628, =0.1.0, =0.1.1, =0.1.0,...

CVE-2021-23411

The CVE-2021-23411 entry concerns the anchorme/anchorme.js library. Affected versions expose a Cross-site Scripting (XSS) vulnerability in the main functionality that converts input URLs into anchor tags, allowing user-controlled input to inject JavaScript into the resulting HTML output. Root cau...

@antlerengineering/components (>=2.4.0, <=2.10.3), @antlerengineering/form-builder (>=2.1.7, <=2.4.1) +79 more potentially affected by CVE-2021-23411 via anchorme (>=0.7.2, <=3.0.8)

anchorme NPM version =0.7.2, =2.4.0, =2.1.7, =2.10.4, =0.2.2, =0.2.2, =0.6.22, =0.0.1, =2.1.0-rc1, =0.0.1, =12.4.0, =0.7.11, =0.6.100, =0.6.100, =0.6.6, =1.1.9, =1.1.14 and more Source cves: CVE-2021-23411 Source advisory: SNYK:JS-ANCHORME-1311008...