Description
This affects the package video.js before 7.14.3. The src attribute of track tag allows to bypass HTML escaping and execute arbitrary code.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | video.js | unspecified – < 7.14.3 | 7.14.3 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | video.js | < 7.14.3 | 7.14.3 | GHSA-pp7m-6j83-m7r6 |
Advisories 2
- ICSA-25-343-02 Festo LX Appliance CISA ICS & IT advisories · Oct 1, 2025
- FSA-202301 Festo: Cross-Site-Scripting (XSS) vulnerability in LX-Appliance CERT@VDE · Oct 1, 2025
References
- https://snyk.io/vuln/SNYK-JS-VIDEOJS-1533429
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1533587
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1533588
- https://github.com/videojs/video.js/commit/b3acf663641fca0f7a966525a72845af7ec5fab2
- FEDORA-2022-f7fdcb1820 vendor-advisory
- FEDORA-2022-cb7084ae1c vendor-advisory
- FEDORA-2022-74a9c8e95f vendor-advisory