Description
All versions of package materialize-css are vulnerable to Cross-site Scripting (XSS) due to improper escape of user input (such as <not-a-tag />) that is being parsed as HTML/JavaScript, and inserted into the Document Object Model (DOM). This vulnerability can be exploited when the user-input is provided to the autocomplete component.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | materialize-css | < unspecified | unspecified |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | materialize-css | <= 1.0.0 | — | GHSA-7jvx-f994-rfw2 |