Description
Scrypted is a home video integration and automation platform. In versions 0.55.0 and prior, a reflected cross-site scripting vulnerability exists in the plugin-http.ts file via the `owner' and 'pkg` parameters. An attacker can run arbitrary JavaScript code.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| koush | scrypted | <= 0.55.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @scrypted/server | <= 0.55.0 | — | GHSA-xmhh-xrcc-mx36 |