medium5.4
CVE-2021-23784
This affects the package tempura before 0.4.0.
Impact
This affects the package tempura before 0.4.0. If the input to the esc function is of type object (i.e an array) it is returned without being escaped/sanitized, leading to a potential Cross-Site Scripting vulnerability.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Tempura Project | Tempura | before 0.4.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/lukeed/tempura/commit/58a5c3671e2f36b26810e77ead9e0dd471902f9b
- https://github.com/lukeed/tempura/releases/tag/v0.4.0
- https://snyk.io/vuln/SNYK-JS-TEMPURA-1569633
- https://github.com/lukeed/tempura/commit/58a5c3671e2f36b26810e77ead9e0dd471902f9b
- https://github.com/lukeed/tempura/releases/tag/v0.4.0
- https://snyk.io/vuln/SNYK-JS-TEMPURA-1569633