MEDIUM

GHSA-r9q4-w3fm-wrm2

Cross-Site Scripting in google-closure-library

Quick fix

GHSA-r9q4-w3fm-wrm2 — google-closure-library: upgrade to the fixed version with the command below.

npm install google-closure-library@20190301.0.0

Details

Versions of `google-closure-library` prior to 20190301.0.0 are vulnerable to Cross-Site Scripting. The `safedomtreeprocessor.processToString()` function improperly processed empty elements, which could allow attackers to execute arbitrary JavaScript through Mutation Cross-Site Scripting.

## Recommendation

Upgrade to version 20190301.0.0 or later.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/google-closure-library

Introduced in: 0Fixed in: 20190301.0.0

Fixnpm install google-closure-library@20190301.0.0

References

https://github.com/google/closure-library/commit/c79ab48e8e962fee57e68739c00e16b9934c0ffa#commitcomment-33294853[WEB]
https://github.com/google/closure-library[PACKAGE]
https://snyk.io/vuln/SNYK-JS-GOOGLECLOSURELIBRARY-174519[WEB]
https://www.npmjs.com/advisories/878[WEB]