Description
The public node module versions <= 1.0.3 allows to embed HTML in file names, which (in certain conditions) might lead to execute malicious JavaScript.
Remediation
References
https://hackerone.com/reports/316346
Related Vulnerabilities
CVE-2022-41713 Vulnerability in maven package org.webjars.npm:deep-object-diff
CVE-2022-37262 Vulnerability in npm package steal
CVE-2021-21160 Vulnerability in npm package electron
CVE-2020-7647 Vulnerability in maven package org.jooby:jooby
CVE-2021-40525 Vulnerability in maven package org.apache.james:james-server