MEDIUM6.5

GHSA-vh5w-fg69-rc8m

Improper Input Validation in Google Closure Library

Quick fix

GHSA-vh5w-fg69-rc8m — google-closure-library: upgrade to the fixed version with the command below.

npm install google-closure-library@20200315.0.0

Details

A URL parsing issue in goog.uri of the Google Closure Library versions up to and including v20200224 allows an attacker to send malicious URLs to be parsed by the library and return the wrong authority. Mitigation -- update your library to version v20200315.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/google-closure-library

Introduced in: 0Fixed in: 20200315.0.0

Fixnpm install google-closure-library@20200315.0.0

References

https://nvd.nist.gov/vuln/detail/CVE-2020-8910[ADVISORY]
https://github.com/google/closure-library/commit/294fc00b01d248419d8f8de37580adf2a0024fc9[WEB]
https://github.com/google/closure-library/releases/tag/v20200315[WEB]