Cross-Site Scripting in hexo-admin

HOCHGHSA-phph-xpj4-wvcv · Published 03/09/2020 · updated 29/09/2021

Kurz gesagt

GHSA-phph-xpj4-wvcv ist eine Schwachstelle (HOCH) in hexo-admin.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
hexo-admin npm	`≥ 0.0.0`	No fix yet

Description

All versions of hexo-admin are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize rendered markdown, allowing attackers to execute arbitrary JavaScript in a victim's browser if they are able to create new posts.

Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

References

jaredly/hexo-admin · WEB
jaredly/hexo-admin · PACKAGE
npmjs.com/advisories/1211 · WEB

Weitere Schwachstellen in hexo-admin

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free