Description
XSS in buttle npm package version 0.2.0 causes execution of attacker-provided code in the victim's browser when an attacker creates an arbitrary file on the server.
Remediation
References
https://hackerone.com/reports/331110
Related Vulnerabilities
CVE-2022-24728 Vulnerability in npm package ckeditor4
CVE-2018-6874 Vulnerability in maven package org.webjars.bower:auth0-lock
CVE-2018-1272 Vulnerability in maven package org.springframework:spring-webmvc
CVE-2022-0155 Vulnerability in npm package follow-redirects
CVE-2020-35476 Vulnerability in maven package net.opentsdb:opentsdb