CVE-2018-3747 Cross-Site Scripting in public
MediumCVSS 6.1
EPSS 0.92%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The public node module versions <= 1.0.3 allows to embed HTML in file names, which (in certain conditions) might lead to execute malicious JavaScript.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm public(npm) | < 0.1.4 | 0.1.4 |
| public.js project public.js | <= 0.1.3 | No fix listed |
References
- nvd.nist.gov third-party-advisory
- hackerone.com
- github.com
- www.npmjs.com
- hackerone.com exploit third-party-advisory