[@imput/cobalt-web] Cross-site Scripting when downloading picker image from malicious instance
Summary
[@imput/cobalt-web] Cross-site Scripting when downloading picker image from malicious instance
Original description
The description as published by the source.
cobalt is a media downloader that doesn't piss you off. A malicious cobalt instance could serve links with the javascript: protocol, resulting in Cross-site Scripting (XSS) when the user tries to download an item from a picker. This issue has been present since commit 66bac03e, was mitigated in commit 97977efa (correctly configured web instances were no longer vulnerable) and fully fixed in commit c4be1d3a (included in release version 10.2.1). Users are advised to upgrade. Users unable to upgrade should enable a content-security-policy.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- patch github.com
- patch github.com