high7.2
CVE-2024-43370
gettext.js has a Cross-site Scripting injection
Impact
### Impact Possible vulnerability to XSS injection if .po dictionary definition files is corrupted ### Patches Update gettext.js to 2.0.3 ### Workarounds Make sure you control the origin of the definition catalog to prevent the use of this flaw in the definition of plural forms.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | gettext.js | < 2.0.3 | 2.0.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/guillaumepotier/gettext.js/commit/8150aeba833183e14c2291a8a148b8f79d1d68d8
- https://github.com/guillaumepotier/gettext.js/security/advisories/GHSA-vwhg-jwr4-vxgg
- https://github.com/advisories/GHSA-vwhg-jwr4-vxgg
- https://nvd.nist.gov/vuln/detail/CVE-2024-43370