MEDIUM6.1
GHSA-5jjq-8cvj-v6m9
Cross-site Scripting in Serenity
Quick fix
GHSA-5jjq-8cvj-v6m9 — Serenity.Net.Core: upgrade to the fixed version with the command below.
dotnet add package Serenity.Net.Core --version 6.8.0Details
Serenity before 6.8.0 allows XSS via an email link because LoginPage.tsx permits return URLs that do not begin with a / character.
Are you affected?
Enter the version of the package you're using.
Affected packages
NuGet/Serenity.Net.Core
Introduced in:
0Fixed in: 6.8.0Fix
dotnet add package Serenity.Net.Core --version 6.8.0