CVE-2019-5422

EPSS 0.27%

Cross-Site Scripting in buttle

Published: 4/8/2019Modified: 11/8/2023

Description

All versions of `buttle` are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code. ## Recommendation No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages (1)

npm/buttlefrom 0, <= 0.2.0

References (6)

ADVISORYhttps://github.com/advisories/GHSA-gm29-35c7-8cfw
ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2019-5422
WEBhttps://hackerone.com/reports/331032
WEBhttps://hackerone.com/reports/331110
WEBhttps://www.npmjs.com/advisories/1009
WEBhttps://www.npmjs.com/advisories/667