Cross-Site Scripting in bracket-template

HIGHGHSA-jj6g-7j8p-7gf2 · Published 30/05/2019 · updated 31/08/2020

In short

GHSA-jj6g-7j8p-7gf2 is a HIGH vulnerability affecting bracket-template.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
bracket-template npm	`≤ 1.1.5`	No fix yet

Description

All versions of bracket-template are vulnerable to stored cross-site scripting (XSS). This is exploitable when a variable passed in via a GET parameter is used in a template.

Recommendation

No fix is currently available for this vulnerability. It is our recommendation to not install or use this module at this time.

References

hackerone.com/reports/317125 · WEB
npmjs.com/advisories/608 · WEB

More vulnerabilities in bracket-template

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free