| Package | Affected versions | Patched versions |
|---|---|---|
| jsreport | < 3.11.3 | 3.11.3 |
| jsreport | < 3.11.3 | 3.11.3 |
jsreport prior to 3.11.3 had a version of vm2 vulnerable to CVE-2023-29017 hard coded in the package.json of the jsreport-core component. An attacker can use this vulnerability to obtain the authority of the jsreport playground server, or construct a malicious webpage/html file and send it to the user to attack the installed jsreport client.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free