GHSA-F8RQ-M28H-8HXJ Cross-Site Scripting in htmr

Versions of htmr prior to 0.8.7 are vulnerable to Cross-Site Scripting XSS. The package uses innerHTML to unescape HTML entities. This may lead to DOM-based XSS through HTML-encoded XSS payloads. This may allow an attacker to execute arbitrary JavaScript in a victim's browser. Recommendation...

@adhitiadarmawan/tmcomponents (0.0.1), @aothechbcn/frontend-idealbar--lib-idealbar (>=1.0.0, <=1.0.10) +17 more potentially affected by unknown CVE via htmr (>=0.4.10, <=0.7.0)

htmr NPM version =0.4.10, =1.0.0, =0.0.1-alpha.100, =1.0.0-beta.1, =1.0.0-beta.5, =1.12.0, =1.5.0, =2.2.0, =1.27.0, =1.1.0, =1.1.0, =5.17.0, =1.1.0, =1.0.0, =5.0.0, =5.1.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-F8RQ-M28H-8HXJ...

Cross-Site Scripting in htmr

Versions of htmr prior to 0.8.7 are vulnerable to Cross-Site Scripting XSS. The package uses innerHTML to unescape HTML entities. This may lead to DOM-based XSS through HTML-encoded XSS payloads. This may allow an attacker to execute arbitrary JavaScript in a victim's browser. Recommendation...

Cross-Site Scripting

Overview Versions of htmr prior to 0.8.7 are vulnerable to Cross-Site Scripting XSS. The package uses innerHTML to unescape HTML entities. This may lead to DOM-based XSS through HTML-encoded XSS payloads. This may allow an attacker to execute arbitrary JavaScript in a victim's browser...

Cross-site Scripting (XSS)

htmr is vulnerable to cross-site scripting XSS. The vulnerability exists through the improper handling of the value of node.textContent in src/browser.ts...

Node.js third-party modules: [htmr] DOM-based XSS

Hi, I would like to report DOM-based XSS in htmr. It allows attackers to insert malicious JavaScript payload into the page. Module module name: htmr version: 0.8.6 npm page: https://www.npmjs.com/package/htmr Module Description Simple and lightweight Hash: $window.location.hash; 4. Run the server...