MEDIUM6.8

GHSA-grw5-g9h2-wpg8

Cross-site Scripting in bootstrap-table

Quick fix

GHSA-grw5-g9h2-wpg8 — bootstrap-table: upgrade to the fixed version with the command below.

npm install bootstrap-table@1.20.2

Details

Bootstrap Tables XSS vulnerability with Table Export plug-in when exportOptions: htmlContent is true in GitHub repository wenzhixin/bootstrap-table prior to 1.20.2. Disclosing session cookies, disclosing secure session data, exfiltrating data to third-parties.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/bootstrap-table

Introduced in: 0Fixed in: 1.20.2

Fixnpm install bootstrap-table@1.20.2

References

https://nvd.nist.gov/vuln/detail/CVE-2022-1726[ADVISORY]
https://github.com/wenzhixin/bootstrap-table/commit/b4a1e5dd332be652e0bc376fd9256886cf4bbde9[WEB]
https://github.com/wenzhixin/bootstrap-table[PACKAGE]
https://huntr.dev/bounties/9b85cc33-0395-4c31-8a42-3a94beb2efea[WEB]