GHSA-v9wp-8r97-v6xg Cross-Site Scripting in jquery.json-viewer
Attackers can execute arbitrary JavaScript in victims' browsers via malicious JSON payloads due to insufficient input sanitization in jquery.json-viewer.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-v9wp-8r97-v6xg?
GHSA-v9wp-8r97-v6xg is a cross-site scripting vulnerability in jquery.json-viewer, published on 3 Sep 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Versions of jquery.json-viewer prior to 1.3.0 are vulnerable to Cross-Site Scripting (XSS). The package insufficiently sanitizes user input when creating links, and concatenates the user input in an <a> tag. This allows attackers to create malicious links with JSON payloads such as:
{
"foo": "https://bar.com\" onmouseover=alert('xss') \""
}
This may lead to arbitrary JavaScript execution in a victim's browser.
Recommendation
Upgrade to version 1.3.0 or later.
Which versions are affected by GHSA-v9wp-8r97-v6xg?
2 open source packages ship an affected version, including jquery.json-viewer.
| Package | Affected | Fixed in |
|---|---|---|
jquery.json-viewer npm | All versions | 1.3.0 |
jquery.json-viewer npm | All versions | 1.3.0 |
How do I fix GHSA-v9wp-8r97-v6xg?
Upgrade jquery.json-viewer to 1.3.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-v9wp-8r97-v6xg being exploited?
There is no known exploitation of GHSA-v9wp-8r97-v6xg in the wild and no public exploit code.