MEDIUM6.1
GHSA-6rjc-4pwr-3vp7
Cross-Site Scripting in iobroker.web
Quick fix
GHSA-6rjc-4pwr-3vp7 — iobroker.web: upgrade to the fixed version with the command below.
npm install iobroker.web@2.4.10Details
Versions of `iobroker.web` prior to 2.4.10 are vulnerable to Cross-Site Scripting. The package fails to escape URL parameters that may be reflected in the server response. This can be used by attackers to execute arbitrary JavaScript in the victim's browser.
## Recommendation
Upgrade to version 2.4.10 or later.
Are you affected?
Enter the version of the package you're using.