CVE-2018-3773: Stored Cross-Site Scripting in metascraper
Summary
CVE-2018-3773: metascraper before v5.2.0 vulnerable to stored cross-site scripting. Affects metascraper versions < 5.2.0. Fixed in 5.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
metascraper is an npm package used for scraping metadata from web pages. It provides a convenient way to extract information such as title, description, and images from URLs. However, versions prior to 5.2.0 are vulnerable to stored cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability in metascraper allows an attacker to inject malicious scripts into the scraped metadata, which can then be executed by unsuspecting users. This can lead to various consequences, including unauthorized access to sensitive information, session hijacking, and the potential for further exploitation of the affected system. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Minimum fixed version
5.2.0
This is the first release that contains the fix.
npm install metascraper@5.2.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, metascraper versions prior to 5.2.0 are vulnerable to stored cross-site scripting (XSS) attacks. It is crucial to upgrade to the latest version to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for metascraper →
FAQ
metascraper is an npm package used for scraping metadata from web pages. It provides a convenient way to extract information such as title, description, and images from URLs.
Stored cross-site scripting (XSS) is a type of vulnerability that allows an attacker to inject malicious scripts into a website or application. These scripts are then executed by unsuspecting users, potentially leading to unauthorized access, data theft, or other malicious activities.
The consequences of this vulnerability include unauthorized access to sensitive information, session hijacking, and the potential for further exploitation of the affected system.
The CVSS score of this vulnerability is 6.1, indicating a moderate severity level.
To fix this vulnerability, you should upgrade to version 5.2.0 or later of metascraper. This version includes security patches that prevent the injection of malicious scripts.
