Open mend-bolt-for-github[bot] opened 2 years ago
lightweight, efficient Tags input component in Vanilla JS / React / Angular [super customizable, tiny size & top performance]
Library home page: https://registry.npmjs.org/@yaireo/tagify/-/tagify-3.18.1.tgz
Path to dependency file: /src/main/resources/static/package.json
Path to vulnerable library: /src/main/resources/static/node_modules/@yaireo/tagify/package.json
Dependency Hierarchy: - :x: **tagify-3.18.1.tgz** (Vulnerable Library)
Found in HEAD commit: 9a42779a6daef915c91e89c0460f3af92f8a822a
Found in base branch: master
This affects the package @yaireo/tagify before 4.9.8. The package is used for rendering UI components inside the input or text fields, and an attacker can pass a malicious placeholder value to it to fire the XSS payload.
Publish Date: 2022-04-29
URL: CVE-2022-25854
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25854
Release Date: 2022-04-29
Fix Resolution: 4.9.8
Step up your Open Source Security Game with Mend here
CVE-2022-25854 - Medium Severity Vulnerability
lightweight, efficient Tags input component in Vanilla JS / React / Angular [super customizable, tiny size & top performance]
Library home page: https://registry.npmjs.org/@yaireo/tagify/-/tagify-3.18.1.tgz
Path to dependency file: /src/main/resources/static/package.json
Path to vulnerable library: /src/main/resources/static/node_modules/@yaireo/tagify/package.json
Dependency Hierarchy: - :x: **tagify-3.18.1.tgz** (Vulnerable Library)
Found in HEAD commit: 9a42779a6daef915c91e89c0460f3af92f8a822a
Found in base branch: master
This affects the package @yaireo/tagify before 4.9.8. The package is used for rendering UI components inside the input or text fields, and an attacker can pass a malicious placeholder value to it to fire the XSS payload.
Publish Date: 2022-04-29
URL: CVE-2022-25854
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25854
Release Date: 2022-04-29
Fix Resolution: 4.9.8
Step up your Open Source Security Game with Mend here