CVE-2024-43796
express vulnerable to XSS via response.redirect()
Summary
express vulnerable to XSS via response.redirect()
Original description
The description as published by the source.
Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2024-43796 node-express
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com