Description
dojox is vulnerable to Cross-site Scripting in all versions before version 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7 and 1.11.9. This is due to dojox.xmpp.util.xmlEncode only encoding the first occurrence of each character, not all of them.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | dojox | all versions before version 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7 and 1.11.9. | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dojo | 1.15.2+dfsg1-1 | — |
| Debian 13 | dojo | 1.15.2+dfsg1-1 | — |
| Debian 12 | dojo | 1.15.2+dfsg1-1 | — |
| Debian 8 | dojo | 1.10.2+dfsg-1+deb8u2 | DLA-2127-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | dojo | 1.15.4+dfsg1-1ubuntu0.1 | USN-7569-1 |
| Ubuntu 18.04 LTS | dojo | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | dojo | 1.15.0+dfsg1-1ubuntu0.1~esm1 | USN-7569-1 |
| Ubuntu Pro 16.04 LTS | dojo | 1.10.4+dfsg-2ubuntu0.1~esm1 | USN-7569-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | dojox | < 1.11.9 | 1.11.9 | GHSA-pg97-ww7h-5mjr |
| npm | dojox | >= 1.12.0, < 1.12.7 | 1.12.7 | GHSA-pg97-ww7h-5mjr |
| npm | dojox | >= 1.13.0, < 1.13.6 | 1.13.6 | GHSA-pg97-ww7h-5mjr |
| npm | dojox | >= 1.14.0, < 1.14.5 | 1.14.5 | GHSA-pg97-ww7h-5mjr |
| npm | dojox | >= 1.15.0, < 1.15.2 | 1.15.2 | GHSA-pg97-ww7h-5mjr |
| npm | dojox | >= 1.16.0, < 1.16.1 | 1.16.1 | GHSA-pg97-ww7h-5mjr |
Advisories 3
- USN-7569-1 dojo vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- DLA-2127-1 dojo - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2023-0809 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 19, 2024