HIGH7.3

GHSA-r96p-v3cr-gfv8

Cross-site Scripting (XSS) in @scullyio/scully

Quick fix

GHSA-r96p-v3cr-gfv8 — @scullyio/scully: upgrade to the fixed version with the command below.

npm install @scullyio/scully@1.0.9

Details

This affects the package @scullyio/scully before 1.0.9. The transfer state is serialised with the JSON.stringify() function and then written into the HTML page.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/@scullyio/scully

Introduced in: 0Fixed in: 1.0.9

Fixnpm install @scullyio/scully@1.0.9

npm/@scullyio/ng-lib

Introduced in: 0Fixed in: 1.0.1

Fixnpm install @scullyio/ng-lib@1.0.1

References

https://nvd.nist.gov/vuln/detail/CVE-2020-28470[ADVISORY]
https://github.com/scullyio/scully/pull/1182[WEB]
https://github.com/scullyio/scully[PACKAGE]
https://snyk.io/vuln/SNYK-JS-SCULLYIOSCULLY-1055829[WEB]