critical9.9
CVE-2024-42515
Glossarizer Cross-site Scripting vulnerability
Impact
Glossarizer through 1.5.2 improperly tries to convert text into HTML. Even though the application itself escapes special characters (e.g., <>), the underlying library converts these encoded characters into legitimate HTML, thereby possibly causing stored XSS. Attackers can append a XSS payload to a word that has a corresponding glossary entry.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | glossarizer | <= 1.5.2 | none recorded |
Affected products
| Product | Affected versions |
|---|---|
| Glossarizer | through 1.5.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/PebbleRoad/glossarizer
- https://herolab.usd.de/security-advisories/usd-2024-0011/
- https://www.npmjs.com/package/glossarizer
- https://github.com/advisories/GHSA-hhhv-ggjx-q9j2
- https://nvd.nist.gov/vuln/detail/CVE-2024-42515
- https://herolab.usd.de/security-advisories/usd-2024-0011