CVE-2021-33040: Cross-site Scripting in epubjs
Summary
CVE-2021-33040: Cross-site Scripting in epubjs. Affects epubjs versions < 0.3.89. Fixed in 0.3.89. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
epubjs is an npm package that provides a JavaScript library for rendering EPUB documents in the browser. It allows developers to display and interact with EPUB files, which are a popular format for digital books. The package is widely used in web applications that require EPUB rendering capabilities.
Vulnerability Detail
The vulnerability identified as CVE-2021-33040 is a Cross-site Scripting (XSS) vulnerability in epubjs. Specifically, the issue resides in the 'managers/views/iframe.js' file of the package, prior to version 0.3.89. This vulnerability allows an attacker to inject malicious scripts into the application, which can then be executed in the context of the user's browser. The impact of this vulnerability can range from unauthorized data access to full control of the user's session.
How To Fix
Minimum fixed version
0.3.89
This is the first release that contains the fix.
npm install epubjs@0.3.89Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can implement input validation and sanitization measures to mitigate the risk of XSS attacks. This can involve using security libraries or frameworks that provide built-in protection against XSS vulnerabilities. Additionally, developers should ensure that user-generated content is properly encoded or escaped before being rendered in the application.
Conclusion
The CVE-2021-33040 vulnerability in epubjs exposes applications to Cross-site Scripting attacks. It is crucial for developers to upgrade to version 0.3.89 or later of the package to mitigate this vulnerability. Implementing input validation and sanitization measures can provide temporary protection until the upgrade is completed. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for epubjs →
FAQ
epubjs is an npm package that allows developers to render and interact with EPUB documents in web applications.
Cross-site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by users.
The impact of this vulnerability can range from unauthorized data access to full control of the user's session.
To fix this vulnerability, it is recommended to upgrade to version 0.3.89 or later of the epubjs package.
As a temporary workaround, developers can implement input validation and sanitization measures to mitigate the risk of XSS attacks.
