CVE-2018-3735: Reflected XSS vulnerability in bracket-template
Summary
CVE-2018-3735: bracket-template vulnerable to reflected XSS. Affects bracket-template versions < 1.1.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
bracket-template is an npm package used for template rendering. It allows users to pass variables to templates, which are then rendered and displayed. However, a vulnerability exists in bracket-template where a reflected XSS attack is possible when a variable passed via a GET parameter is used in the template.
Vulnerability Detail
The vulnerability in bracket-template arises from a lack of proper input sanitization. When a user-supplied variable is included in the template without proper validation or encoding, an attacker can craft a malicious URL that includes JavaScript code. When the template is rendered with this URL, the JavaScript code is executed in the context of the user's browser, potentially leading to unauthorized actions or data theft. This vulnerability has a CVSS score of 6.1, indicating a moderate severity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
A possible workaround for this vulnerability is to manually sanitize and validate user input before passing it to the template. This can be done by using functions like 'encodeURIComponent()' to encode user-supplied values. However, it is strongly advised to update to the latest version of bracket-template instead of relying on workarounds.
Conclusion
In conclusion, bracket-template is vulnerable to a reflected XSS attack when user-supplied input is not properly sanitized and validated. It is crucial to update to the latest version of bracket-template and implement proper input sanitization to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bracket-template →
FAQ
bracket-template is an npm package used for template rendering.
A reflected XSS vulnerability occurs when user-supplied input is not properly validated or encoded, allowing an attacker to inject and execute malicious code in the context of a user's browser.
This vulnerability can lead to unauthorized actions or data theft, as an attacker can execute arbitrary JavaScript code in the user's browser.
To fix this vulnerability, update to the latest version of bracket-template and ensure that user-supplied input is properly sanitized and validated before including it in the template.
A possible workaround is to manually sanitize and validate user input before passing it to the template. However, it is recommended to update to the latest version of bracket-template instead of relying on workarounds.
Related vulnerabilities
Recent vulnerabilities recorded for bracket-template.
