Description

This affects the package @scullyio/scully before 1.0.9. The transfer state is serialised with the JSON.stringify() function and then written into the HTML page.

Remediation

References

https://github.com/scullyio/scully/pull/1182

https://snyk.io/vuln/SNYK-JS-SCULLYIOSCULLY-1055829

Related Vulnerabilities

CVE-2017-5645 Vulnerability in maven package org.apache.logging.log4j:log4j-core

CVE-2022-24999 Vulnerability in maven package org.webjars:qs

CVE-2023-26474 Vulnerability in maven package org.xwiki.platform:xwiki-platform-oldcore

CVE-2021-41580 Vulnerability in npm package passport-oauth2

CVE-2022-41642 Vulnerability in npm package nadesiko3

Severity

High

Classification

CWE-79 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Patch Vendor Advisory Third Party Advisory