Cross-Site Scripting in shave

MOYENNE 6.1CVE-2019-12313 · GHSA-gh4g-3gm9-5wrq · Published 24/05/2019 · updated 17/06/2026

En bref

CVE-2019-12313 est une vulnérabilité MOYENNE (CVSS 6.1) touchant shave (dollarshaveclub), shave.
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.3%, plus élevée que 69.7% des vulnérabilités.
Correctif : mettre à jour vers 2.5.3 ou plus récent.

Package	Affected versions	Patched versions
shave dollarshaveclub	`< 2.5.3`	`2.5.3`
shave npm	`< 2.5.3`	`2.5.3`

Description

Versions of shave prior to 2.5.3 are vulnerable to Cross-Site Scripting. The shave package overwrites HTML elements and in doing so fails to properly encode the output. If encoded HTML input is passed into shave the output will be decoded which may lead to Cross-Site Scripting.

Recommendation

Upgrade to version 2.5.3 or later.

NVD description

XSS exists in Shave before 2.5.3 because output encoding is mishandled during the overwrite of an HTML element.

References

nvd.nist.gov/vuln/detail/CVE-2019-12313 · ADVISORY
dollarshaveclub/shave commit da7371b · WEB
dollarshaveclub/shave · WEB
npmjs.com/advisories/822 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free