CVE-2023-1767

The Snyk Advisor website https://snyk.io/advisor/ was vulnerable to a stored XSS prior to 28th March 2023. A feature of Snyk Advisor is to display the contents of a scanned package's Readme on its package health page. An attacker could create a package in NPM with an associated markdown README fi...

Design/Logic Flaw

The Snyk Advisor website https://snyk.io/advisor/ was vulnerable to a stored XSS prior to 28th March 2023. A feature of Snyk Advisor is to display the contents of a scanned package's Readme on its package health page. An attacker could create a package in NPM with an associated markdown README fi...

CVE-2023-1767

CVE-2023-1767 concerns a stored XSS in the Snyk Advisor web app. The component that displays a scanned package’s README on the package health page could execute HTML/JS when end users view the package, allowing an attacker to craft a package with an XSS-enabled README. Root cause: insufficient sa...

PT-2023-17227 · Snyk · Snyk Advisor

Name of the Vulnerable Software and Affected Versions: Snyk Advisor versions prior to 28th March 2023 Description: The issue concerns a stored XSS vulnerability. A feature of Snyk Advisor is to display the contents of a scanned package's Readme on its package health page. An attacker could create...