medium5.4
CVE-2023-32325
Potential for cross-site scripting in PostHog-js
Impact
### Impact Potential for cross-site scripting in `posthog-js`. ### Patches The problem has been patched in `posthog-js` version 1.57.2. ### Workarounds - This isn't an issue for sites that have a Content Security Policy in place. - Using the HTML tracking snippet on PostHog Cloud always guarantees the latest version of the library – in that case no action is required to upgrade to the patched version. ### References We will publish details of the vulnerability in 30 days as per our [security policy](https://posthog.com/handbook/company/security#policies).
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | posthog-js | < 1.57.2 | 1.57.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Posthog | Posthog-Js | before 1.57.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/PostHog/posthog-js/commit/67e07eb8bb271a3a6f4aa251382e4d25abb385a0
- https://github.com/PostHog/posthog-js/security/advisories/GHSA-8775-5hwv-wr6v
- https://github.com/advisories/GHSA-8775-5hwv-wr6v
- https://github.com/PostHog/posthog-js/pull/630
- https://nvd.nist.gov/vuln/detail/CVE-2023-32325