CVE-2019-10062: Cross-site Scripting in aurelia-framework
Summary
CVE-2019-10062: Cross-site Scripting in aurelia-framework. Affects aurelia-framework versions < 1.4.1. Fixed in 1.4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The aurelia-framework is an open-source JavaScript framework for building web applications. It provides a modular architecture and a set of powerful features for creating dynamic and responsive user interfaces. The framework is widely used in the development of single-page applications and has a large community of developers contributing to its growth and improvement. However, the framework is vulnerable to a cross-site scripting (XSS) attack, which can allow remote attackers to inject malicious code into web pages and potentially compromise user data and system security.
Vulnerability Detail
The vulnerability in the aurelia-framework lies in the HTMLSanitizer class, specifically in the html-sanitizer.ts file. The sanitizer only attempts to filter SCRIPT elements, which leaves other elements vulnerable to XSS attacks. This means that an attacker can inject JavaScript code into attributes of various elements, potentially leading to the execution of malicious scripts in the context of the affected user's browser. The vulnerability can be exploited by manipulating the SCRIPT string, such as by splitting and nesting them. This can allow an attacker to bypass the sanitizer's filtering and execute arbitrary code. The impact of this vulnerability can range from defacement of web pages to the theft of sensitive user information.
How To Fix
Latest published version: 1.4.1 as of 23 Oct 2026
npm install aurelia-framework@1.4.1The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version of the aurelia-framework is not immediately feasible, developers can implement a workaround by manually sanitizing user input and ensuring that it is properly encoded before being rendered in HTML. This can help mitigate the risk of XSS attacks until the framework can be updated.
Conclusion
The aurelia-framework is vulnerable to a cross-site scripting (XSS) attack due to a flaw in the HTMLSanitizer class. This vulnerability can allow remote attackers to inject malicious code into web pages and potentially compromise user data and system security. Developers should update to the latest version of the framework, version 1.4.1 or later, to fix this vulnerability. In the meantime, implementing a workaround by manually sanitizing user input can help mitigate the risk of XSS attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for aurelia-framework →
FAQ
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to the execution of arbitrary code in the context of the affected user's browser and potentially compromise user data and system security.
An attacker can exploit this vulnerability by injecting JavaScript code into attributes of various elements in web pages. This can be done by manipulating the SCRIPT string, such as by splitting and nesting them, to bypass the sanitizer's filtering and execute arbitrary code.
The potential consequences of this vulnerability include defacement of web pages, theft of sensitive user information, and the execution of arbitrary code in the context of the affected user's browser. This can lead to further compromise of the system and potential harm to users.
Yes, a fix for this vulnerability is available in version 1.4.1 or later of the aurelia-framework. Developers should update to the latest version to ensure they are protected against this vulnerability.
If updating to the latest version of the aurelia-framework is not immediately feasible, developers can implement a workaround by manually sanitizing user input and ensuring that it is properly encoded before being rendered in HTML. This can help mitigate the risk of XSS attacks until the framework can be updated.
