Cross-site Scripting (XSS)

2021-09-0110:00:16

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

29.4%

JSON

next is vulnerable to cross-site scripting. An attacker is able to inject and execute malicious scirpt via image optimization API if next.config.js file have images.domains array assigned and the image host assigned in images.domains which allows user-provided SVG.

CPENameOperatorVersion
nextle11.1.1-canary.17
nextle11.1.1-canary.17

CPE	Name	Operator	Version
	next	le	11.1.1-canary.17
	next	le	11.1.1-canary.17

References

github.com/vercel/next.js/commit/7afc97c5744b38bdf36aa7f87625f438224688aa

github.com/vercel/next.js/releases/tag/v11.1.1

github.com/vercel/next.js/security/advisories/GHSA-9gr3-7897-pp7m

0.001 Low

EPSS

Percentile

29.4%

JSON

Related for VERACODE:31897