Description
Affected versions of `gmail-js` are vulnerable to cross-site scripting in the `tools.parse_response`, `helper.get.visible_emails_post`, and `helper.get.email_data_post` functions, which pass user input directly into the Function constructor.
## Recommendation
Update to version 0.6.5 or later.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | gmail-js | < 0.6.5 | 0.6.5 | GHSA-c7pp-g2v2-2766 |