Cross-Site Scripting in public

MITTEL 6.1CVE-2018-3747 · GHSA-8p5p-ff7x-hw7q · Published 03/07/2018 · updated 17/06/2026

Kurz gesagt

CVE-2018-3747 ist eine Schwachstelle (MITTEL (CVSS 6.1)) in public.js (public.js project), public.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.93%, höher als bei 60.8% aller Schwachstellen.
Abhilfe: auf 0.1.4 oder neuer aktualisieren.

Package	Affected versions	Patched versions
public.js public.js_project	`≤ 0.1.3`	No fix yet
public npm	`< 0.1.4`	`0.1.4`

Description

Versions of public prior to 0.1.4 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.

Recommendation

Upgrade to version 0.1.4 or later.

NVD description

The public node module versions <= 1.0.3 allows to embed HTML in file names, which (in certain conditions) might lead to execute malicious JavaScript.

References

nvd.nist.gov/vuln/detail/CVE-2018-3747 · ADVISORY
hackerone.com/reports/316346 · WEB
hackerone.com/reports/329950 · WEB
GitHub Advisory GHSA-8p5p-ff7x-hw7q · ADVISORY
npmjs.com/advisories/1000 · WEB

Weitere Schwachstellen in public.js

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free