Reflected Cross-site Scripting (XSS)

2023-02-2712:16:36

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

generator-hottowel

reflected cross-site scripting

javascript injection

404 response object

app/templates/src/server/_app.js

EPSS

0.001

Percentile

34.8%

JSON

generator-hottowel is vulnerable to Reflected Cross-site Scripting (XSS) attacks. The library does not properly handle invalid calls to assets as it uses a custom 404 response object, allowing an attacker to inject and execute JavaScript through the app.use function in app/templates/src/server/_app.js.