Cross-Site Scripting Vulnerability in @ionic/core
Summary
GHSA-r3xc-47qg-h929: Cross-Site Scripting in @ionic/core. Affects @ionic/core across 4 version ranges.
< 4.0.3
>= 4.1.0, < 4.1.3
>= 4.2.0, < 4.2.1
>= 4.3.0, < 4.3.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @ionic/core package is a part of the Ionic framework, which is used for building cross-platform mobile applications using web technologies such as HTML, CSS, and JavaScript. It provides a set of UI components and tools for creating interactive and responsive mobile app interfaces. However, versions prior to 4.0.3, 4.1.3, 4.2.1, or 4.3.1 of @ionic/core are vulnerable to a Cross-Site Scripting (XSS) attack.
Vulnerability Detail
The vulnerability in @ionic/core arises from the unsafe use of the innerHTML function without proper input sanitization. This allows attackers to inject and execute arbitrary JavaScript code on the victim's browser. The following components are affected by this vulnerability: <ion-alert>.message, <ion-searchbar>.placeholder, <ion-infinite-scroll-content>.loadingText, <ion-refresher-content>.pullingText, and <ion-refresher-content>.refreshingText. An attacker can exploit this vulnerability to perform various malicious actions, such as stealing sensitive user information, manipulating the application's behavior, or performing unauthorized actions on behalf of the user.
How To Fix
Latest published version: 9.0.9 as of 22 Oct 2026
npm install @ionic/core@9.0.9Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.0.34.0.3npm install @ionic/core@4.0.3 -
>= 4.1.0, < 4.1.34.1.3npm install @ionic/core@4.1.3 -
>= 4.2.0, < 4.2.14.2.1npm install @ionic/core@4.2.1 -
>= 4.3.0, < 4.3.14.3.1npm install @ionic/core@4.3.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to manually sanitize the input before using it with the affected components. This can be done by using a library or function that sanitizes HTML input, such as DOMPurify. Here's an example of how to use DOMPurify to sanitize the input:
import DOMPurify from 'dompurify';
const sanitizedInput = DOMPurify.sanitize(userInput);
Conclusion
The Cross-Site Scripting vulnerability in @ionic/core can allow attackers to execute arbitrary JavaScript code on the victim's browser, leading to various malicious actions. To mitigate this vulnerability, it is crucial to upgrade to the latest version of @ionic/core or apply the provided workaround. Regularly updating packages and following secure coding practices are essential for maintaining the security of applications.
See every vulnerability recorded for @ionic/core →
FAQ
Cross-Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to various attacks, such as stealing sensitive information, manipulating website content, or performing actions on behalf of the user.
The Cross-Site Scripting vulnerability in @ionic/core can be exploited by an attacker who can inject malicious scripts into the affected components. This can be done by manipulating user input or crafting specific requests to the application.
The potential consequences of this vulnerability include unauthorized access to sensitive user information, manipulation of application behavior, and performing actions on behalf of the user without their consent. This can lead to privacy breaches, data theft, and unauthorized activities.
There have been no specific reports of this vulnerability being exploited in the wild. However, it is important to address this vulnerability promptly to prevent potential attacks and protect user data.
Upgrading to the patched versions or applying the workaround are the recommended mitigation measures for this vulnerability. It is important to keep the @ionic/core package up to date to ensure the latest security fixes are applied.
