EUVD-2023-0339

Malicious code in bioql PyPI...

Cross-site Scripting (XSS)

phoenixhtml is vulnerable to Cross-Site Scripting XSS attacks. The library does not properly escape the special characters before it outputs to the front end, allowing an attacker to inject and execute malicious JavaScript via HEEx class attributes in tag.ex...

GHSA-5G2H-9X5V-5H3X phoenix_html allows Cross-site Scripting in HEEx class attributes

tag.ex in Phoenix Phoenix.HTML aka phoenixhtml before 3.0.4 allows XSS in HEEx class attributes...

@makerdao/testchain-client (>=0.0.1 <=0.3.0-beta.0) potentially affected by CVE-2021-46871 via phoenix_html (=2.14.3)

phoenixhtml NPM version =2.14.3 is affected by a known vulnerability. The following packages have a transitive dependency on phoenixhtml and may be impacted: - @makerdao/testchain-client =0.0.1, =0.3.0-beta.0 Source cves: CVE-2021-46871 Source advisory: OSV:GHSA-5G2H-9X5V-5H3X...