| Package | Affected versions | Patched versions |
|---|---|---|
| jquery.json-viewer | < 1.3.0 | 1.3.0 |
Versions of jquery.json-viewer prior to 1.3.0 are vulnerable to Cross-Site Scripting (XSS). The package insufficiently sanitizes user input when creating links, and concatenates the user input in an <a> tag. This allows attackers to create malicious links with JSON payloads such as:
{
"foo": "https://bar.com\" onmouseover=alert('xss') \""
}
This may lead to arbitrary JavaScript execution in a victim's browser.
Upgrade to version 1.3.0 or later.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free