VDB
Sign up
MEDIUM6.4

GHSA-6gg3-pmm7-97xc

DOM-based XSS in auth0-lock

Quick fix

GHSA-6gg3-pmm7-97xc — auth0-lock: upgrade to the fixed version with the command below.

npm install auth0-lock@11.26.3

Details

### Overview Versions before and including `11.25.1` are using `dangerouslySetInnerHTML` to display an informational message when used with a Passwordless or Enterprise connection.

- For Passwordless connection, the value of the input (email or phone number) is displayed back to the user while waiting for verification code input. - For Enterprise connection, the value of the input (IdP Domain) from the Enterprise connection setup screen (Auth0 Dashboard) is displayed back to the user when the `lock` widget opens.

When Passwordless or Enterprise connection is used, the application and its users might be exposed to cross-site scripting (XSS) attacks.

### Am I affected? You are affected by this vulnerability if all of the following conditions apply:

- You are using auth0-lock - You are using Passwordless or Enterprise connection mode

### How to fix that? Upgrade to version `11.26.3`

### Will this update impact my users? The fix provided in patch will not affect your users.

### Credit https://github.com/mvisat

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/auth0-lock
Introduced in: 0Fixed in: 11.26.3
Fixnpm install auth0-lock@11.26.3

References