CVE-2023-41049
Improper Neutralization of Script in Attributes in @dcl/single-sign-on-client
概要
Improper Neutralization of Script in Attributes in @dcl/single-sign-on-client
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
@dcl/single-sign-on-client is an open source npm library which deals with single sign on authentication flows. Improper input validation in the init function allows arbitrary javascript to be executed using the javascript: prefix. This vulnerability has been patched on version 0.1.0. Users are advised to upgrade. Users unable to upgrade should limit untrusted user input to the init function.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com