CVE-2021-23411

Description

All versions of package anchorme are vulnerable to Cross-site Scripting (XSS) via the main functionality.

How to fix CVE-2021-23411

No fixed version has been published yet. Mitigate by removing the affected package or applying upstream guidance from the references below.

• npm/anchorme—no fix listed

Is CVE-2021-23411 being exploited?

Low — EPSS is 0.3%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, <= 2.1.2

CVSS scores

References (5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-23411
• WEBgithub.com/alexcorvi/anchorme.js/blob/gh-pages/src/transform.ts#23L81
• WEBgithub.com/alexcorvi/anchorme.js/blob/gh-pages/src/transform.ts%23L81
• WEBsnyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1320695