Cross-Site Scripting in dojo
Moderate severity
GitHub Reviewed
Published
Sep 11, 2019
to the GitHub Advisory Database
•
Updated Jan 9, 2023
Package
Affected versions
= 1.13.0
>= 1.12.0, < 1.12.4
>= 1.11.0, < 1.11.6
>= 1.10.0, < 1.10.10
Patched versions
1.13.1
1.12.4
1.11.6
1.10.10
Description
Reviewed
Sep 4, 2019
Published to the GitHub Advisory Database
Sep 11, 2019
Last updated
Jan 9, 2023
Versions of
dojoprior to 1.4.2 are vulnerable to DOM-based Cross-Site Scripting (XSS). The package does not sanitize URL parameters in the_testCommon.jsandrunner.htmltest files, allowing attackers to execute arbitrary JavaScript in the victim's browser.Recommendation
Upgrade to version 1.4.2 or later.
References