GHSA-788m-pj96-7w2c Cross-Site Scripting in fomantic-ui
Attackers can execute arbitrary scripts in victim browsers via unencoded input in fomantic-ui dropdowns, requiring user interaction.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-788m-pj96-7w2c?
GHSA-788m-pj96-7w2c is a cross-site scripting vulnerability in fomantic-ui, published on 2 Sep 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Versions of fomantic-ui are vulnerable to Cross-Site Scripting. Lack of output encoding on the selection dropdowns can lead to user input being executed instead of printed as text.
Recommendation
Upgrade to version 2.7.0 or later.
Which versions are affected by GHSA-788m-pj96-7w2c?
2 open source packages ship an affected version, including fomantic-ui.
| Package | Affected | Fixed in |
|---|---|---|
fomantic-ui npm | All versions | 2.7.0 |
fomantic-ui npm | All versions | 2.7.0 |
How do I fix GHSA-788m-pj96-7w2c?
Upgrade fomantic-ui to 2.7.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-788m-pj96-7w2c being exploited?
There is no known exploitation of GHSA-788m-pj96-7w2c in the wild and no public exploit code.