CVE-2019-15478: Cross-Site Scripting in status-board
Summary
CVE-2019-15478: Cross-Site Scripting in status-board. Affects status-board versions < 1.1.82. Fixed in 1.1.82. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The status-board package is an npm package used for creating status boards or dashboards. It allows users to render dynamic content on a web page. However, all versions of status-board are vulnerable to Cross-Site Scripting (XSS) attacks.
Vulnerability Detail
The vulnerability in status-board is due to insufficient sanitization of user-controlled input in the renderJsDashboard() function. This function concatenates the safeDashboard variable to the HTTP response message without proper validation. As a result, if the safeDashboard variable is controlled by user input, it can be manipulated to execute arbitrary JavaScript code in a victim's browser. This can lead to various malicious activities, such as stealing sensitive information or performing actions on behalf of the victim.
How To Fix
Latest published version: 1.1.83 as of 23 Oct 2026
npm install status-board@1.1.83Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.1.82
This is the first release that contains the fix.
npm install status-board@1.1.82Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As there is no fix available, the best workaround is to switch to a different package that does not have this vulnerability. Ensure that the alternative package has proper input validation and sanitization to prevent XSS attacks.
Conclusion
The status-board package is vulnerable to Cross-Site Scripting (XSS) attacks, allowing attackers to execute arbitrary JavaScript code in a victim's browser. Unfortunately, no fix is currently available for this vulnerability. It is recommended to switch to an alternative package that does not have this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for status-board →
FAQ
Cross-Site Scripting (XSS) is a type of security vulnerability where an attacker can inject malicious scripts into web pages viewed by other users. This allows the attacker to execute arbitrary code in the victim's browser and potentially steal sensitive information or perform unauthorized actions.
The vulnerability in status-board arises from the renderJsDashboard() function not properly sanitizing user-controlled input. This allows an attacker to inject malicious JavaScript code into the safeDashboard variable, which is then concatenated to the HTTP response message without validation.
The consequences of this vulnerability can vary depending on the attacker's intentions. They can steal sensitive information, such as login credentials or personal data, from users who view the compromised status board. They can also perform actions on behalf of the victim, such as making unauthorized changes to the status board or performing actions within the application.
No, there is currently no fix available for this vulnerability in the status-board package. It is recommended to switch to an alternative package that does not have this vulnerability.
To protect your application from XSS attacks, ensure that all user-controlled input is properly validated and sanitized before being rendered in HTML or JavaScript contexts. Use security libraries or frameworks that provide built-in protection against XSS, such as output encoding or content security policies.
References
Related vulnerabilities
Recent vulnerabilities recorded for status-board.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
