CVE-2017-16015 Cross-Site Scripting in forms
MediumCVSS 6.1
EPSS 0.82%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Forms is a library for easily creating HTML forms. Versions before 1.3.0 did not have proper html escaping. This means that if the application did not sanitize html on behalf of forms, use of forms may be vulnerable to cross site scripting
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm forms(npm) | < 1.3.0 | 1.3.0 |
| forms project forms | < 1.3.0 | 1.3.0 |
| HackerOne forms node module | = <1.3.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory
- github.com patch
- github.com
- www.npmjs.com
- nodesecurity.io third-party-advisory