Description
Morris.js creates an svg graph, with labels that appear when hovering over a point. The hovering label names are not escaped in versions 0.5.0 and earlier. If control over the labels is obtained, script can be injected. The script will run on the client side whenever that specific graph is loaded.
Remediation
References
https://github.com/morrisjs/morris.js/pull/464
https://nodesecurity.io/advisories/307
Related Vulnerabilities
CVE-2019-5484 Vulnerability in maven package org.webjars.npm:bower
CVE-2022-31367 Vulnerability in npm package @strapi/strapi
CVE-2023-40813 Vulnerability in maven package org.opencrx:opencrx-core-models
CVE-2017-16017 Vulnerability in npm package npm
CVE-2023-37956 Vulnerability in maven package org.jenkins-ci.plugins:test-results-aggregator