En bref
- CVE-2019-5422 est une vulnérabilité MOYENNE (CVSS 6.1) touchant buttle (buttle project), buttle.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.2%, plus élevée que 67.6% des vulnérabilités.
- Aucune version corrigée n'est encore connue : suivez l'avis de l'éditeur dans les références.
| Package | Affected versions | Patched versions |
|---|
| buttle | = 0.2.0
| No fix yet |
| buttle npm | ≤ 0.2.0
| No fix yet |
Description
All versions of buttle are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.
Recommendation
No fix is currently available. Consider using an alternative package until a fix is made available.
NVD description
XSS in buttle npm package version 0.2.0 causes execution of attacker-provided code in the victim's browser when an attacker creates an arbitrary file on the server.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free