Description
This affects all versions of package lightning-server. It is possible to inject malicious JavaScript code as part of a session controller.
Remediation
References
https://github.com/lightning-viz/lightning/blob/master/app/controllers/session.js
https://github.com/lightning-viz/lightning/blob/master/app/controllers/session.js%23L230
https://snyk.io/vuln/SNYK-JS-LIGHTNINGSERVER-1019381
Related Vulnerabilities
CVE-2023-46998 Vulnerability in maven package org.webjars.bower:bootbox
CVE-2023-4863 Vulnerability in npm package electron
CVE-2022-23080 Vulnerability in npm package directus
CVE-2023-50730 Vulnerability in maven package org.typelevel:grackle-core_native0.4_3
CVE-2023-28444 Vulnerability in npm package angular-server-side-configuration