Description

This affects the package tempura before 0.4.0. If the input to the esc function is of type object (i.e an array) it is returned without being escaped/sanitized, leading to a potential Cross-Site Scripting vulnerability.

Remediation

References

https://github.com/lukeed/tempura/commit/58a5c3671e2f36b26810e77ead9e0dd471902f9b

https://github.com/lukeed/tempura/releases/tag/v0.4.0

https://snyk.io/vuln/SNYK-JS-TEMPURA-1569633

Related Vulnerabilities

CVE-2019-1003049 Vulnerability in maven package org.jenkins-ci.main:jenkins-core

CVE-2022-23944 Vulnerability in maven package org.apache.shenyu:shenyu-common

CVE-2023-36478 Vulnerability in maven package org.eclipse.jetty.http2:http2-hpack

CVE-2022-43406 Vulnerability in maven package org.jenkins-ci.plugins.workflow:workflow-cps-global-lib

CVE-2022-41940 Vulnerability in maven package org.webjars.npm:engine.io

Severity

High

Classification

CWE-79 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Patch Third Party Advisory Release Notes Exploit Mitigation VDB Entry