MEDIUM6.1

GHSA-rjvg-8v36-xv9r

element-plus vulnerable to cross-site scripting (XSS) via el-table-column

Quick fix

GHSA-rjvg-8v36-xv9r — element-plus: upgrade to the fixed version with the command below.

npm install element-plus@2.0.6

Details

element-plus below 2.0.5 is vulnerable to Cross Site Scripting (XSS) when attribute `show-tooltips-overflow` of `el-table-column` is true. The mouseover action will make the text of this column render as html.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/element-plus

Introduced in: 0Fixed in: 2.0.6

Fixnpm install element-plus@2.0.6

References

https://nvd.nist.gov/vuln/detail/CVE-2022-27103[ADVISORY]
https://github.com/asjdf/element-table-xss-test/issues/1[WEB]
https://github.com/element-plus/element-plus/issues/6514[WEB]
https://github.com/element-plus/element-plus/pull/6520[WEB]
https://github.com/element-plus/element-plus/commit/063c56446135176971f532bd0eb2e88a0b137d43[WEB]
https://github.com/asjdf/element-table-xss-test[WEB]
https://github.com/element-plus/element-plus[PACKAGE]