Description
Stage.js through 0.8.10 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Piqnt | Stage.js | ≤ 0.8.10 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | stage-js | <= 0.8.10 | — | GHSA-fp3m-g5rc-4c28 |