CVE-2024-23841
@apollo/experimental-nextjs-app-support Cross-site Scripting vulnerability
Description
### Impact The @apollo/experimental-apollo-client-nextjs NPM package is vulnerable to a cross-site scripting vulnerability. This vulnerability arises from improper handling of untrusted input when @apollo/experimental-apollo-client-nextjs performs server-side rendering of HTML pages. To fix this vulnerability, we implemented appropriate escaping to prevent javascript injection into rendered pages. ### Patches To fix this issue, please update to version 0.7.0 or later. ### Workarounds There are no known workarounds for this issue. Please update to version 0.7.0
How to fix CVE-2024-23841
To remediate CVE-2024-23841, upgrade the affected package to a fixed version below.
- —upgrade to 0.7.0 or later
Is CVE-2024-23841 being exploited?
Low — EPSS is 0.5%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 0.7.0
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N |