Cross-Site Scripting (XSS)

2021-06-2105:05:25

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

cross-site scripting

type-confusion vulnerability

unsantized strings

array-like object

arbitrary javascript

user's browser

software

EPSS

0.001

Percentile

48.3%

JSON

striptags is vulnerable to cross-site scripting (XSS). A type-confusion vulnerability occurs when concatenating unsanitized strings when an array-like object is passed in as the html parameter. An attacker who is able to control the shape of their input can abuse this behavior to inject and execute arbitrary Javascript in a user’s browser.