CVE-2024-28635: Cross-site scripting in Survey Creator
Summary
CVE-2024-28635: Cross-site scripting in Survey Creator. Affects survey-creator versions < 1.9.133. Fixed in 1.9.133. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SurveyJS Survey Creator is an npm package that provides a user-friendly interface for creating surveys. It allows users to design and customize surveys by providing various question types, themes, and options. The package is widely used by developers to integrate survey creation functionality into their applications. However, versions 1.9.132 and earlier of SurveyJS Survey Creator are vulnerable to a Cross-Site Scripting (XSS) attack.
Vulnerability Detail
The vulnerability (CVE-2024-28635) in SurveyJS Survey Creator allows attackers to execute arbitrary code and obtain sensitive information by exploiting a Cross-Site Scripting (XSS) vulnerability. This vulnerability arises from improper input sanitization of the 'title' parameter in a form. An attacker can inject malicious code into the 'title' parameter, which is then executed when the form is rendered in a user's browser. This can lead to the theft of sensitive information, session hijacking, or the execution of arbitrary actions on behalf of the user.
How To Fix
Latest published version: 1.12.67 as of 23 Oct 2026
npm install survey-creator@1.12.67Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.9.133
This is the first release that contains the fix.
npm install survey-creator@1.9.133Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, developers can implement a temporary workaround by manually sanitizing the 'title' parameter before rendering it in the form. This can be done by using a library or function that escapes or removes any potentially malicious code from the input. Here's an example of how to sanitize the 'title' parameter using the 'xss' library:
const xss = require('xss');
const sanitizedTitle = xss(title);
By applying this workaround, the risk of XSS attacks can be mitigated until the package is updated.
Conclusion
The Cross-Site Scripting (XSS) vulnerability in SurveyJS Survey Creator (CVE-2024-28635) poses a risk to applications using versions 1.9.132 and earlier. It allows attackers to execute arbitrary code and obtain sensitive information. To mitigate this vulnerability, developers should upgrade to version 1.9.133 or later of the package. If immediate upgrading is not possible, applying a temporary workaround by sanitizing the 'title' parameter can help reduce the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for survey-creator →
FAQ
This vulnerability allows attackers to execute arbitrary code and obtain sensitive information. It can lead to the theft of user data, session hijacking, or the execution of unauthorized actions on behalf of the user.
Developers using SurveyJS Survey Creator versions 1.9.132 and earlier are affected by this vulnerability.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is important to promptly update the package to prevent any potential exploitation.
Yes, the vulnerability has been fixed in version 1.9.133 of the SurveyJS Survey Creator package.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file.
