medium6.1
CVE-2023-3481
Critters Cross-site Scripting Vulnerability
Impact
### Impact Critters version 0.0.17-0.0.19 have an issue when parsing the HTML which leads to a potential [cross-site scripting (XSS)](https://owasp.org/www-community/attacks/xss/) bug. ### Patches The bug has been fixed in `v0.0.20`. ### Workarounds Upgrading Critters version to `>0.0.20` is the easiest fix. This is a non breaking version upgrade so we recommend all users to use `v0.0.20`.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | critters | >= 0.0.17, <= 0.0.19 | 0.0.20 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Critters | from 0.0.17 through 0.0.19 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/GoogleChromeLabs/critters/security/advisories/GHSA-cx3j-qqxj-9597
- https://github.com/advisories/GHSA-cx3j-qqxj-9597
- https://github.com/GoogleChromeLabs/critters/pull/133
- https://github.com/GoogleChromeLabs/critters/commit/7757902c9e0b3285d516359b3cb602cd9d50d80e
- https://nvd.nist.gov/vuln/detail/CVE-2023-3481