Description
@dcl/single-sign-on-client is an open source npm library which deals with single sign on authentication flows. Improper input validation in the `init` function allows arbitrary javascript to be executed using the `javascript:` prefix. This vulnerability has been patched on version `0.1.0`. Users are advised to upgrade. Users unable to upgrade should limit untrusted user input to the `init` function.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| decentraland | single-sign-on-client | < 0.1.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @dcl/single-sign-on-client | < 0.1.0 | 0.1.0 | GHSA-vp4f-wxgw-7x8x |