DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS
Résumé
DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Rollup is a module bundler for JavaScript. Versions prior to 2.79.2, 3.29.5, and 4.22.4 are susceptible to a DOM Clobbering vulnerability when bundling scripts with properties from import.meta (e.g., import.meta.url) in cjs/umd/iife format. The DOM Clobbering gadget can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an img tag with an unsanitized name attribute) are present. Versions 2.79.2, 3.29.5, and 4.22.4 contain a patch for the vulnerability.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2024-47068 node-rollup
- Ubuntu UBUNTU-CVE-2024-47068 node-rollup
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- patch github.com
- web github.com
- web github.com