high7.5
CVE-2023-41049
Improper Neutralization of Script in Attributes in @dcl/single-sign-on-client
Impact
### Impact Improper input validation in the `init` function allows arbitrary javascript to be executed using the `javascript:` prefix ```ts SSO.init('javascript:alert("javascript successfully injected")') ``` ### Patches This vulnerability was patched on version `0.1.0` ### Workarounds This vulnerability can be prevented if user input correctly sanitized or there is no user input pass to the `init` function
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @dcl/single-sign-on-client | < 0.1.0 | 0.1.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Decentraland | Single Sign On Client | before 0.1.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/decentraland/single-sign-on-client/commit/bd20ea9533d0cda30809d929db85b1b76cef855a
- https://github.com/decentraland/single-sign-on-client/security/advisories/GHSA-vp4f-wxgw-7x8x
- https://github.com/advisories/GHSA-vp4f-wxgw-7x8x
- https://nvd.nist.gov/vuln/detail/CVE-2023-41049
- https://github.com/decentraland/single-sign-on-client/pull/2