Description
Scrypted is a home video integration and automation platform. In versions 0.55.0 and prior, a reflected cross-site scripting vulnerability exists in the login page via the `redirect_uri` parameter. By specifying a url with the javascript scheme (`javascript:`), an attacker can run arbitrary JavaScript code after the login.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| koush | scrypted | <= 0.55.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @scrypted/core | <= 0.1.142 | — | GHSA-ww7p-8gfg-v82r |