Description
In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM. When dangerouslySetInnerHTML is used, the application and its users might be exposed to cross-site scripting (XSS) attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| auth0 | lock | <= 11.25.1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | auth0-lock | < 11.26.3 | 11.26.3 | GHSA-6gg3-pmm7-97xc |