5x5_uploader (>=1.0.0, <=1.2.2), @3t-transform/threeteeui (>=0.0.1, <=0.0.6) +136 more potentially affected by CVE-2022-25349 via materialize-css (>=1.0.0-rc.1, <=1.0.0)

materialize-css NPM version =1.0.0-rc.1, =1.0.0, =0.0.1, =1.0.1, =1.0.3, =1.0.0, =0.0.3, =1.0.2, =0.0.4, =0.0.6, =1.0.0, =1.0.0, =1.0.19, =1.0.8, =1.2.12 - @mariaav/tutorial 1.0.0 - @mariaav/tutorial2 1.0.0 and more Source cves: CVE-2022-25349 Source advisory: GHSA-7JVX-F994-RFW2...

CVE-2022-25349

All versions of package materialize-css are vulnerable to Cross-site Scripting XSS due to improper escape of user input such as not-a-tag / that is being parsed as HTML/JavaScript, and inserted into the Document Object Model DOM. This vulnerability can be exploited when the user-input is provided...

CVE-2022-25349

CVE-2022-25349 affects materialize-css: XSS caused by improper escaping of user input in the autocomplete component, allowing input such as to be parsed as HTML/JavaScript and executed in the DOM. Connected sources (Veracode, OSV, SNYK) confirm all versions are vulnerable with the root cause in ...

CVE-2022-25349

Removed by vendor...

CVE-2022-25349 Cross-site Scripting (XSS)

All versions of package materialize-css are vulnerable to Cross-site Scripting XSS due to improper escape of user input such as not-a-tag / that is being parsed as HTML/JavaScript, and inserted into the Document Object Model DOM. This vulnerability can be exploited when the user-input is provided...