CVE-2017-16043: HTML Injection in shout
Summary
CVE-2017-16043: HTML Injection in shout. Affects shout versions >= 0.44.0, < 0.50.0. Fixed in 0.50.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The shout package is an npm package used for messaging and communication purposes. It provides functionality for sending messages and managing topics. The package is vulnerable to HTML injection in the /topic command, which can lead to cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability in shout arises from the lack of proper escaping in the /topic command. This allows an attacker to inject malicious HTML code into messages, potentially leading to XSS attacks. The impact of this vulnerability can range from unauthorized access to sensitive information to the execution of arbitrary code on the victim's browser.
How To Fix
Minimum fixed version
0.50.0
This is the first release that contains the fix.
npm install shout@0.50.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The shout package is vulnerable to HTML injection, which can lead to cross-site scripting attacks. To mitigate this vulnerability, it is crucial to update to version 0.50.0 or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for shout →
FAQ
The vulnerability allows an attacker to inject malicious HTML code into messages, potentially leading to cross-site scripting (XSS) attacks. This can result in unauthorized access to sensitive information or the execution of arbitrary code on the victim's browser.
Updating to version 0.50.0 or later of the shout package will fix the vulnerability. It is recommended to regularly update packages to ensure the latest security patches are applied.
There are no known public exploits for this vulnerability at the time of this advisory.
No, there is no CVSS score provided for this vulnerability.
You can find more information about this vulnerability in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/11/GHSA-26q7-g57v-mxcp/GHSA-26q7-g57v-mxcp.json
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
