Critters Cross-site Scripting Vulnerability

MEDIUM 6.1CVE-2023-3481 · GHSA-cx3j-qqxj-9597 · Published 21/08/2023 · updated 17/06/2026

In short

CVE-2023-3481 is a MEDIUM (CVSS 6.1) vulnerability affecting critters (google), critters.
Chance of exploitation in the next 30 days (EPSS): 0.17%, higher than 6.3% of all vulnerabilities.
Fix: update to 0.0.20 or later.

Package	Affected versions	Patched versions
critters google	`≥ 0.0.17, ≤ 0.0.19`	No fix yet
critters npm	`≥ 0.0.17, < 0.0.20`	`0.0.20`

Description

Impact

Critters version 0.0.17-0.0.19 have an issue when parsing the HTML which leads to a potential cross-site scripting (XSS) bug.

Patches

The bug has been fixed in v0.0.20.

Workarounds

Upgrading Critters version to >0.0.20 is the easiest fix. This is a non breaking version upgrade so we recommend all users to use v0.0.20.

NVD description

Critters versions 0.0.17-0.0.19 have an issue when parsing the HTML, which leads to a potential cross-site scripting (XSS) bug. We recommend upgrading to version 0.0.20 of the extension.

References

GoogleChromeLabs/critters security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2023-3481 · ADVISORY
GoogleChromeLabs/critters#133 · WEB
GoogleChromeLabs/critters commit 7757902 · WEB
GoogleChromeLabs/critters · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free