@adhitiadarmawan/tmcomponents (0.0.1), @aothechbcn/frontend-idealbar--lib-idealbar (>=1.0.0, <=1.0.10) +17 more potentially affected by unknown CVE via htmr (>=0.4.10, <=0.7.0)

htmr NPM version =0.4.10, =1.0.0, =0.0.1-alpha.100, =1.0.0-beta.1, =1.0.0-beta.5, =1.12.0, =1.5.0, =2.2.0, =1.27.0, =1.1.0, =1.1.0, =5.19.0-beta.5, =1.4.0, =1.0.0, =5.0.0, =5.1.0 and more Source cves: unknown CVE Source advisory: MEND:WS-2020-0094...

WS-2020-0094

htmr before 0.8.7 is vulnerable to Cross-Site Scripting XSS. The package uses innerHTML to unescape HTML entities. This may lead to DOM-based XSS through HTML-encoded XSS payloads. This may allow an attacker to execute arbitrary JavaScript in a victim's browser...

Cross-Site Scripting in htmr

Versions of htmr prior to 0.8.7 are vulnerable to Cross-Site Scripting XSS. The package uses innerHTML to unescape HTML entities. This may lead to DOM-based XSS through HTML-encoded XSS payloads. This may allow an attacker to execute arbitrary JavaScript in a victim's browser. Recommendation...

@adhitiadarmawan/tmcomponents (0.0.1), @aothechbcn/frontend-idealbar--lib-idealbar (>=1.0.0, <=1.0.10) +17 more potentially affected by unknown CVE via htmr (>=0.4.10, <=0.7.0)

htmr NPM version =0.4.10, =1.0.0, =0.0.1-alpha.100, =1.0.0-beta.1, =1.0.0-beta.5, =1.12.0, =1.5.0, =2.2.0, =1.27.0, =1.1.0, =1.1.0, =5.19.0-beta.5, =1.4.0, =1.0.0, =5.0.0, =5.1.0 and more Source cves: unknown CVE Source advisory: GHSA-F8RQ-M28H-8HXJ...

GHSA-F8RQ-M28H-8HXJ Cross-Site Scripting in htmr

Versions of htmr prior to 0.8.7 are vulnerable to Cross-Site Scripting XSS. The package uses innerHTML to unescape HTML entities. This may lead to DOM-based XSS through HTML-encoded XSS payloads. This may allow an attacker to execute arbitrary JavaScript in a victim's browser. Recommendation...

@adhitiadarmawan/tmcomponents (0.0.1), @aothechbcn/frontend-idealbar--lib-idealbar (>=1.0.0, <=1.0.10) +17 more potentially affected by unknown CVE via htmr (>=0.4.10, <=0.7.0)

htmr NPM version =0.4.10, =1.0.0, =0.0.1-alpha.100, =1.0.0-beta.1, =1.0.0-beta.5, =1.12.0, =1.5.0, =2.2.0, =1.27.0, =1.1.0, =1.1.0, =5.19.0-beta.5, =1.4.0, =1.0.0, =5.0.0, =5.1.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-F8RQ-M28H-8HXJ...

PT-2020-21270

Name of the Vulnerable Software and Affected Versions htmr versions prior to 0.8.7 Description The issue arises from the use of innerHTML to unescape HTML entities, potentially leading to DOM-based XSS attacks through HTML-encoded XSS payloads. This could allow an attacker to execute arbitrary...

Cross-Site Scripting

Overview Versions of htmr prior to 0.8.7 are vulnerable to Cross-Site Scripting XSS. The package uses innerHTML to unescape HTML entities. This may lead to DOM-based XSS through HTML-encoded XSS payloads. This may allow an attacker to execute arbitrary JavaScript in a victim's browser...

Cross-site Scripting (XSS)

htmr is vulnerable to cross-site scripting XSS. The vulnerability exists through the improper handling of the value of node.textContent in src/browser.ts...

Node.js third-party modules: [htmr] DOM-based XSS

Hi, I would like to report DOM-based XSS in htmr. It allows attackers to insert malicious JavaScript payload into the page. Module module name: htmr version: 0.8.6 npm page: https://www.npmjs.com/package/htmr Module Description Simple and lightweight Hash: $window.location.hash; 4. Run the server...