Skip to content
OpenAdvisories
Medium DLA-1946-1 1 CVE

novnc - security update

Published Oct 5, 2019 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 8 novnc 1:0.4+dfsg+1+20131010+gitf68af8af3d-4+deb8u1

Vulnerabilities 1

  • Medium 6.1
    CVE-2017-18635 Public exploit

    Cross-Site Scripting in @novnc/novnc

    An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages propagated to the status field, such as the VNC server name.

    novnc @novnc/novnc novnc Debian Ubuntu npm