medium5.4
CVE-2020-7642
Cross-site scripting in lazysizes
Impact
lazysizes through 5.2.0 allows execution of malicious JavaScript. The following attributes are not sanitized by the video-embed plugin: `data-vimeo`, `data-vimeoparams`, `data-youtube` and `data-ytparams` which can be abused to inject malicious JavaScript.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | lazysizes | <= 5.2.0 | 5.2.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Lazysizes Project | Lazysizes | through 5.2.0 |