Description
This affects all versions of package lightning-server. It is possible to inject malicious JavaScript code as part of a session controller.
Remediation
References
https://github.com/lightning-viz/lightning/blob/master/app/controllers/session.js%23L230
https://snyk.io/vuln/SNYK-JS-LIGHTNINGSERVER-1019381
https://github.com/lightning-viz/lightning/blob/master/app/controllers/session.js
Related Vulnerabilities
CVE-2021-31712 Vulnerability in npm package react-draft-wysiwyg
CVE-2023-1784 Vulnerability in maven package org.jeecgframework.boot:jeecg-boot-parent
CVE-2017-18635 Vulnerability in npm package @novnc/novnc
CVE-2019-16728 Vulnerability in maven package org.webjars.npm:dompurify
CVE-2022-29167 Vulnerability in maven package org.webjars.npm:hawk