MEDIUM5.4
GHSA-8775-5hwv-wr6v
Potential for cross-site scripting in PostHog-js
Quick fix
GHSA-8775-5hwv-wr6v — posthog-js: upgrade to the fixed version with the command below.
npm install posthog-js@1.57.2Details
### Impact
Potential for cross-site scripting in `posthog-js`.
### Patches
The problem has been patched in `posthog-js` version 1.57.2.
### Workarounds
- This isn't an issue for sites that have a Content Security Policy in place. - Using the HTML tracking snippet on PostHog Cloud always guarantees the latest version of the library – in that case no action is required to upgrade to the patched version.
### References
We will publish details of the vulnerability in 30 days as per our [security policy](https://posthog.com/handbook/company/security#policies).
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://github.com/PostHog/posthog-js/security/advisories/GHSA-8775-5hwv-wr6v[WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2023-32325[ADVISORY]
- https://github.com/PostHog/posthog-js/pull/630[WEB]
- https://github.com/PostHog/posthog-js/commit/67e07eb8bb271a3a6f4aa251382e4d25abb385a0[WEB]
- https://github.com/PostHog/posthog-js[PACKAGE]