high7.2
CVE-2024-24556
@urql/next Cross-site Scripting vulnerability
Impact
## impact The `@urql/next` package is vulnerable to XSS. To exploit this an attacker would need to ensure that the response returns `html` tags and that the web-application is using streamed responses (non-RSC). This vulnerability is due to improper escaping of html-like characters in the response-stream. To fix this vulnerability upgrade to version 1.1.1
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @urql/next | < 1.1.1 | 1.1.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nearform | Urql | before 1.1.1 |