CVE-2022-25854 Cross-site Scripting (XSS)

This affects the package @yaireo/tagify before 4.9.8. The package is used for rendering UI components inside the input or text fields, and an attacker can pass a malicious placeholder value to it to fire the XSS payload...

PT-2022-17570 · Npm · @Yaireo/Tagify

Name of the Vulnerable Software and Affected Versions: @yaireo/tagify versions prior to 4.9.8 Description: The issue affects the package used for rendering UI components inside input or text fields. An attacker can pass a malicious placeholder value to fire the cross-site scripting XSS payload...

CVE-2022-25854: Improper Neutralization of Input During Web Page Generation

This affects the package @yaireo/tagify before 4.9.8. The package is used for rendering UI components inside the input or text fields, and an attacker can pass a malicious placeholder value to it to fire the XSS payload...