CVE-2020-7749
Injection and Cross-site Scripting in osm-static-maps
7.6
HIGH
CVSS 3.1
EPSS 0.48%
Description
This affects all versions of package osm-static-maps under 3.9.0. User input given to the package is passed directly to a template without escaping `({{{ ... }}})`. As such, it is possible for an attacker to inject arbitrary HTML/JS code and depending on the context. It will be outputted as an HTML on the page which gives opportunity for XSS or rendered on the server (puppeteer) which also gives opportunity for SSRF and Local File Read.
How to fix CVE-2020-7749
To remediate CVE-2020-7749, upgrade the affected package to a fixed version below.
- —upgrade to 3.9.0 or later
Is CVE-2020-7749 being exploited?
Low — EPSS is 0.5%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 3.9.0
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH7.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L |