原始 OSV JSON
{
"id": "GHSA-f34m-x9pj-62vq",
"aliases": [
"CVE-2021-43785"
],
"details": "### Impact\n\nThere are two vectors for XSS attacks with versions of @joeattardi/emoji-button before 4.6.2:\n\n- A URL for a custom emoji\n- An i18n string\n\nIn both of these cases, a value can be crafted such that it can insert a `script` tag into the page and execute malicious code.\n\n### Patches\n\nThis vulnerability is fixed starting in version 4.6.2. This is resolved by properly escaping strings that are inserted into the HTML document.\n\n### Workarounds\n\nThere is no workaround other than upgrading to a non-vulnerable version.\n\n### Credit\n\nThis issue was discovered by GitHub team member [@erik-krogh (Erik Krogh Kristensen)](https://github.com/erik-krogh) and was reported by the GitHub Security Lab team.",
"summary": "Cross-Site Scripting Vulnerability in @joeattardi/emoji-button",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.6.2"
}
]
}
],
"package": {
"name": "@joeattardi/emoji-button",
"ecosystem": "npm"
}
}
],
"modified": "2021-12-01T14:34:05Z",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L"
}
],
"published": "2021-12-01T18:29:02Z",
"references": [
{
"url": "https://github.com/joeattardi/emoji-button/security/advisories/GHSA-f34m-x9pj-62vq",
"type": "WEB"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43785",
"type": "ADVISORY"
},
{
"url": "https://github.com/joeattardi/emoji-button/commit/05970c09180cd27fff493e998ac5bf0468b1bb16",
"type": "WEB"
},
{
"url": "https://github.com/joeattardi/emoji-button/commit/fe54bef107eb3f74873a4018f2ff49fa124c6a2e",
"type": "WEB"
},
{
"url": "https://github.com/joeattardi/emoji-button",
"type": "PACKAGE"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "HIGH",
"github_reviewed": true,
"nvd_published_at": "2021-11-26T19:15:00Z",
"github_reviewed_at": "2021-11-29T20:21:36Z"
}
}