CVE-2018-16481 Cross-Site Scripting in html-pages
MediumCVSS 6.1
EPSS 0.69%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A XSS vulnerability was found in html-page <=2.1.1 that allows malicious Javascript code to be executed in the user's browser due to the absence of sanitization of the paths before rendering.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm html-pages(npm) | <= 3.1.0 | No fix listed |
| html-pages project html-pages | <= 2.1.1 | No fix listed |
| HackerOne html-pages | = <=2.1.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory
- hackerone.com exploit issue-tracking third-party-advisory
- www.npmjs.com
- github.com