CVE-2019-12313: Cross-Site Scripting in shave
Summary
CVE-2019-12313: Cross-Site Scripting in shave. Affects shave versions < 2.5.3. Fixed in 2.5.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The shave package is an npm package used for overwriting HTML elements. It is commonly used in web development projects to manipulate and modify HTML content. However, versions prior to 2.5.3 are vulnerable to a Cross-Site Scripting (XSS) attack. This means that if encoded HTML input is passed into shave, the output will be decoded, potentially leading to XSS vulnerabilities.
Vulnerability Detail
The vulnerability in shave arises from its failure to properly encode the output when overwriting HTML elements. This allows an attacker to inject malicious scripts into the output, which can be executed by unsuspecting users visiting the affected web page. The impact of this vulnerability can range from stealing sensitive user information to performing unauthorized actions on behalf of the user. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Minimum fixed version
2.5.3
This is the first release that contains the fix.
npm install shave@2.5.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by manually encoding the HTML input before passing it to shave. This can be done using a library or function that provides HTML encoding, such as he or htmlspecialchars. By encoding the input, the output generated by shave will remain safe from XSS vulnerabilities.
Conclusion
In conclusion, the shave package prior to version 2.5.3 is vulnerable to Cross-Site Scripting (XSS) attacks. It is crucial to upgrade to the latest version or apply the provided workaround to mitigate the risk of exploitation. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for shave →
FAQ
shave is an npm package used for overwriting HTML elements in web development projects.
Cross-Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
The impact of this vulnerability can range from stealing sensitive user information to performing unauthorized actions on behalf of the user.
To fix this vulnerability, it is recommended to upgrade to version 2.5.3 or later of the shave package.
Yes, a temporary workaround is to manually encode the HTML input before passing it to shave.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
