Improper Neutralization of Script in Attributes in @dcl/single-sign-on-client
Summary
Improper Neutralization of Script in Attributes in @dcl/single-sign-on-client
Original description
The description as published by the source.
@dcl/single-sign-on-client is an open source npm library which deals with single sign on authentication flows. Improper input validation in the init function allows arbitrary javascript to be executed using the javascript: prefix. This vulnerability has been patched on version 0.1.0. Users are advised to upgrade. Users unable to upgrade should limit untrusted user input to the init function.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com