medium6.1
CVE-2020-7691
Cross-site scripting in jspdf
Impact
It's possible to use nested script tags in order to bypass the filtering regex.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | jspdf | < 2.0.0 | 2.0.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Parall | Jspdf | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-575255
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-575253
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBMRRIO-575254
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-575252
- https://snyk.io/vuln/SNYK-JS-JSPDF-568273
- https://github.com/advisories/GHSA-3q6f-8grx-pr4v
- https://nvd.nist.gov/vuln/detail/CVE-2020-7691
- https://github.com/MrRio/jsPDF/issues/2971
- https://github.com/MrRio/jsPDF/commit/d0323215b1a1cd1c35bf2b213274ae1e4797715d