MEDIUM6.1

GHSA-qp2q-6h9j-jg2r

Cross-site Scripting in jquery.json-viewer

Quick fix

GHSA-qp2q-6h9j-jg2r — jquery.json-viewer: upgrade to the fixed version with the command below.

npm install jquery.json-viewer@1.5.0

Details

The jquery.json-viewer library before version 1.5.0 for Node.js does not properly escape characters such as < in a JSON object, as demonstrated by a SCRIPT element.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/jquery.json-viewer

Introduced in: 0Fixed in: 1.5.0

Fixnpm install jquery.json-viewer@1.5.0

References

https://nvd.nist.gov/vuln/detail/CVE-2022-30241[ADVISORY]
https://github.com/abodelot/jquery.json-viewer/pull/26[WEB]
https://github.com/abodelot/jquery.json-viewer[PACKAGE]
https://github.com/abodelot/jquery.json-viewer/releases/tag/v1.5.0[WEB]
https://www.npmjs.com/package/jquery.json-viewer[WEB]