Description
Vulnogram 1.0.0 contains a stored cross-site scripting vulnerability in comment hypertext handling that allows attackers to inject malicious scripts. Remote attackers can inject XSS payloads through comments to execute arbitrary JavaScript in victims' browsers.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Vulnogram | Vulnogram | 1.0.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | vulnogram | <= 1.0.0 | — | GHSA-vggc-6pg2-xvp9 |
References
- GitHub Security Advisory (GHSA-pg4p-2985-gvxr) vendor-advisory
- https://github.com/Vulnogram/Vulnogram product
- VulnCheck Advisory: Vulnogram - Stored Cross-Site Scripting via Comment Hypertext third-party-advisory