Description
lazysizes through 5.2.0 allows execution of malicious JavaScript. The following attributes are not sanitized by the video-embed plugin: data-vimeo, data-vimeoparams, data-youtube and data-ytparams which can be abused to inject malicious JavaScript.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | lazysizes | All versions including 5.2.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | lazysizes | < 5.2.1 | 5.2.1 | GHSA-hg2p-2cvq-4ppv |