GHSA-w4vp-3mq7-7v82 Cross-Site Scripting in lazysizes
Attackers can execute arbitrary JavaScript in victims' browsers via unsanitized video embed attributes in the lazysizes library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-w4vp-3mq7-7v82?
GHSA-w4vp-3mq7-7v82 is a cross-site scripting vulnerability in lazysizes, published on 3 Sep 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Versions of lazysizes prior to 5.2.1-rc1 are vulnerable to Cross-Site Scripting. The video-embed plugin fails to sanitize the following attributes: data-vimeo, data-vimeoparams, data-youtube and data-ytparams. This allows attackers to execute arbitrary JavaScript in a victim's browser if the attacker has control over the vulnerable attributes.
Recommendation
Upgrade to version 5.2.1-rc1 or later.
Which versions are affected by GHSA-w4vp-3mq7-7v82?
2 open source packages ship an affected version, including lazysizes.
| Package | Affected | Fixed in |
|---|---|---|
lazysizes npm | All versions | 5.2.1-rc1 |
lazysizes npm | All versions | 5.2.1-rc1 |
How do I fix GHSA-w4vp-3mq7-7v82?
Upgrade lazysizes to 5.2.1-rc1 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-w4vp-3mq7-7v82 being exploited?
There is no known exploitation of GHSA-w4vp-3mq7-7v82 in the wild and no public exploit code.