Description
This affects all versions of package lightning-server. It is possible to inject malicious JavaScript code as part of a session controller.
Remediation
References
https://github.com/lightning-viz/lightning/blob/master/app/controllers/session.js
https://github.com/lightning-viz/lightning/blob/master/app/controllers/session.js%23L230
https://snyk.io/vuln/SNYK-JS-LIGHTNINGSERVER-1019381
Related Vulnerabilities
CVE-2020-15250 Vulnerability in maven package junit:junit
CVE-2023-42278 Vulnerability in maven package cn.hutool:hutool-json
CVE-2023-24057 Vulnerability in maven package ca.uhn.hapi.fhir:org.hl7.fhir.r5
CVE-2013-6348 Vulnerability in maven package org.apache.struts:struts2-config-browser-plugin
CVE-2023-37895 Vulnerability in maven package org.apache.jackrabbit:jackrabbit-webapp