Template Injection

2020-10-2103:21:26

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

template injection

osm-static-maps

user input validation

arbitrary javascript/html

perform requests

read local files

EPSS

0.002

Percentile

52.5%

JSON

osm-static-maps is vulnerable to template injection. Lack of validation of user input into the template parameter {{{tileserverUrl}}} allows an attacker to inject arbitrary Javascript/HTML in a user’s browser, perform requests on behalf of the user or read arbitrary local files.