Description
Auth0 Lock before 11.21.0 allows XSS when additionalSignUpFields is used with an untrusted placeholder.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | auth0-lock | < 11.21.0 | 11.21.0 | GHSA-w2pf-g6r8-pg22 |
Medium · 6.1
CVE-2019-20174
EUVD-2020-0280GHSA-w2pf-g6r8-pg22
auth0-lock vulnerable to XSS via unsanitized placeholder property
Published Feb 3, 2020 · Updated Aug 5, 2024 · Assigned by mitre