Improper Neutralization of Script in Attributes in @dcl/single-sign-on-client
Résumé
Improper Neutralization of Script in Attributes in @dcl/single-sign-on-client
Description d'origine
La description telle que publiée par la source (souvent en anglais).
@dcl/single-sign-on-client is an open source npm library which deals with single sign on authentication flows. Improper input validation in the init function allows arbitrary javascript to be executed using the javascript: prefix. This vulnerability has been patched on version 0.1.0. Users are advised to upgrade. Users unable to upgrade should limit untrusted user input to the init function.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com