CVE-2017-16043 HTML Injection in shout
MediumCVSS 6.1
EPSS 1.00%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Shout is an IRC client. Because the /topic command in messages is unescaped, attackers have the ability to inject HTML scripts that will run in the victim's browser. Affects shout >=0.44.0 <=0.49.3.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm shout(npm) | >= 0.44.0, <= 0.49.3 | No fix listed |
| shout project shout | >= 0.44.0, < 0.50.0 | 0.50.0 |
| HackerOne shout node module | = >=0.44.0 <=0.49.3 | No fix listed |
References
- nvd.nist.gov third-party-advisory
- github.com patch third-party-advisory
- github.com
- www.npmjs.com
- nodesecurity.io third-party-advisory