Skip to content
OpenAdvisories

Package · npm

hellojs

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Critical 9.8
    CVE-2021-26505

    MrSwitch hello.js vulnerable to prototype pollution

    Prototype pollution vulnerability in MrSwitch hello.js version 1.18.6, allows remote attackers to execute arbitrary code via hello.utils.extend function.

    hellojs npm
  • Critical 9.9
    CVE-2020-7741

    Cross-site Scripting (XSS)

    This affects the package hellojs before 1.18.6. The code get the param oauth_redirect from url and pass it to location.assign without any check and sanitisation. So we can simply pass some XSS payloads into the url param oauth_redirect, such as javascript:ale…

    hellojs npm