Description
Next.js is a React framework. Starting with version 10.0.0 and prior to version 12.1.0, Next.js is vulnerable to User Interface (UI) Misrepresentation of Critical Information. In order to be affected, the `next.config.js` file must have an `images.domains` array assigned and the image host assigned in `images.domains` must allow user-provided SVG. If the `next.config.js` file has `images.loader` assigned to something other than default, the instance is not affected. Version 12.1.0 contains a patch for this issue. As a workaround, change `next.config.js` to use a different `loader configuration` other than the default.
Remediation
References
Related Vulnerabilities
Drupal Core 4.7.x Multiple Vulnerabilities (4.7.0 - 4.7.1)
WordPress Plugin Tajer Arbitrary File Upload (1.0.5)
WordPress Plugin WP Post Page Clone SQL Injection (1.0)
WordPress Plugin FV Flowplayer Video Player Cross-Site Scripting (7.2.0.727)
Atlassian Jira Permissions, Privileges, and Access Controls Vulnerability (CVE-2007-6619)