LOW
GHSA-9pr3-7449-977r
Cross-Site Scripting in express-cart
Details
All versions of `harp` are vulnerable to Cross-Site Scripting. In the admin page it is possible to inject arbitrary JavaScript as a new product option, allowing attackers to execute arbitrary code. This is limited to the admin page and does not affect other pages.
## Recommendation
No fix is currently available. Consider using an alternative module until a fix is made available.
Are you affected?
Enter the version of the package you're using.
Affected packages
npm/express-cart
Introduced in:
0No fixed version published yet for express-cart (npm). Pin to a known-safe version or switch to an alternative.