Description
Zipline from 4.3.0 before 4.5.0 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject HTML through unescaped embed settings in SSR meta tags. Attackers can set malicious embedTitle, embedDescription, embedSiteName, or embedColor values via PATCH /api/user to execute JavaScript in browsers of visitors opening their file view pages.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| diced | zipline | 4.3.0 – < 4.5.0 | 4.5.0 |
References
- GitHub Security Advisory (GHSA-9j96-vvqc-h9f8) vendor-advisory
- VulnCheck Advisory: Zipline 4.3.0 before 4.5.0 Stored XSS via SSR Embed Meta Tags third-party-advisory