Description
Serenity before 6.8.0 allows XSS via an email link because LoginPage.tsx permits return URLs that do not begin with a / character.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @serenity-is/corelib | < 6.8.0 | 6.8.0 | GHSA-5jjq-8cvj-v6m9 |
| NuGet | Serenity.Net.Core | < 6.8.0 | 6.8.0 | GHSA-5jjq-8cvj-v6m9 |