CVE-2019-20174: Vulnerability in auth0-lock Package - Placeholder Property Abuse
Summary
CVE-2019-20174: auth0-lock vulnerable to XSS via unsanitized placeholder property. Affects auth0-lock versions < 11.21.0. Fixed in 11.21.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The auth0-lock package is an authentication library provided by Auth0. It is used to implement secure authentication and authorization flows in web applications. The package includes a component called Lock, which provides a customizable login and signup interface. Lock version 11.20.4 and earlier are affected by a vulnerability that allows for potential cross-site scripting (XSS) attacks on signup pages. This vulnerability arises from improper sanitization of the generated HTML code when using the additionalSignUpFields customization option with a checkbox field and an untrusted source for the placeholder property.
Vulnerability Detail
The vulnerability in auth0-lock versions 11.20.4 and earlier arises from the lack of proper sanitization of the placeholder property in the additionalSignUpFields customization option. If an untrusted source is used to obtain the placeholder value, it can lead to the injection of malicious HTML code, potentially enabling cross-site scripting attacks on signup pages. An attacker could exploit this vulnerability by manipulating the name query parameter to inject arbitrary HTML code into the placeholder value. This could result in the execution of malicious scripts in the context of the vulnerable application, compromising user data and enabling further attacks.
How To Fix
Latest published version: 15.0.2 as of 23 Oct 2026
npm install auth0-lock@15.0.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
11.21.0
This is the first release that contains the fix.
npm install auth0-lock@11.21.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, developers can mitigate the risk by ensuring that the placeholder value is obtained from trusted sources and does not allow for the injection of arbitrary HTML code.
Conclusion
The vulnerability in the auth0-lock package versions 11.20.4 and earlier allows for potential cross-site scripting (XSS) attacks on signup pages. Developers should upgrade to version 11.21.0 or later and migrate from using the placeholder property to the new placeholderHTML property. This fix ensures the safe handling of HTML content and prevents the injection of malicious code. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for auth0-lock →
FAQ
You are affected by this vulnerability if you are using Auth0 Lock version 11.20.4 or earlier and pass additionalSignUpFields as options when initializing Lock, including a field of type checkbox whose placeholder value is obtained from an untrusted source.
The vulnerability could allow for cross-site scripting (XSS) attacks on signup pages. An attacker could inject malicious HTML code into the placeholder value, potentially compromising user data and enabling further attacks.
To fix this vulnerability, upgrade to Auth0 Lock version 11.21.0 or later. Use the new placeholderHTML property instead of the placeholder property to ensure the safe handling of HTML content.
This update will not impact your users, their current state, or any existing sessions. It only requires changes in application code to migrate from using the placeholder property to the new placeholderHTML property.
Yes, you can still use HTML content in the placeholder by using the new placeholderHTML property. However, make sure the HTML content is obtained from trusted sources to prevent potential security risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for auth0-lock.
