CVE-2022-39350: Persistent Cross-Site-Scripting in @dependencytrack/frontend
Summary
CVE-2022-39350: @dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via Vulnerability Details. Affects @dependencytrack/frontend versions < 4.6.1. Fixed in 4.6.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @dependencytrack/frontend package is a frontend component of the Dependency-Track application. It is responsible for rendering vulnerability details provided in markdown format using the Showdown JavaScript library. However, versions before 4.6.1 did not encode or sanitize the output, making it susceptible to persistent cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability arises from the lack of XSS countermeasures in the Showdown library used by @dependencytrack/frontend. Actors with the 'VULNERABILITY_MANAGEMENT' permission can exploit this weakness by creating or editing a custom vulnerability and injecting XSS payloads in various fields. These payloads can be executed when users with the 'VIEW_PORTFOLIO' permission browse to the modified vulnerability's page. Malicious JavaScript code can be introduced through the Description, Details, Recommendation, and References fields. Although it is unlikely, it is also possible for malicious JavaScript to be introduced via vulnerability databases mirrored by Dependency-Track. The issue has been fixed in version 4.6.1 of the frontend component.
How To Fix
Latest published version: 1.0.0-alpha.9 as of 23 Oct 2026
npm install @dependencytrack/frontend@1.0.0-alpha.9Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.6.1
This is the first release that contains the fix.
npm install @dependencytrack/frontend@4.6.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Updating to the fixed version is the recommended solution.
Conclusion
The @dependencytrack/frontend package is vulnerable to persistent cross-site scripting (XSS) attacks due to the lack of XSS countermeasures in the Showdown library. To mitigate this vulnerability, it is crucial to update to version 4.6.1 or later of the frontend component. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @dependencytrack/frontend →
FAQ
The vulnerability allows attackers to execute arbitrary JavaScript code in the context of the Dependency-Track frontend. This can lead to various malicious activities, such as stealing sensitive user information or performing unauthorized actions on behalf of the user.
Actors with the 'VULNERABILITY_MANAGEMENT' permission in Dependency-Track can exploit this vulnerability by creating or editing a custom vulnerability and injecting XSS payloads.
There are no known instances of this vulnerability being exploited. However, it is important to apply the fix as soon as possible to prevent any potential attacks.
Restricting the 'VULNERABILITY_MANAGEMENT' permission to trusted users can help mitigate the risk of exploitation. However, it is still recommended to update to the fixed version to fully address the vulnerability.
No, the 'Vulnerability Details' element in the 'Audit Vulnerabilities' tab is not affected by this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for @dependencytrack/frontend.
