| Package | Affected versions | Patched versions |
|---|---|---|
| single sign on client | < 0.1.0 | 0.1.0 |
| @dcl/single-sign-on-client | < 0.1.0 | 0.1.0 |
Improper input validation in the init function allows arbitrary javascript to be executed using the javascript: prefix
SSO.init('javascript:alert("javascript successfully injected")')
This vulnerability was patched on version 0.1.0
This vulnerability can be prevented if user input correctly sanitized or there is no user input pass to the init function
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free