Cross-Site Scripting Vulnerability in console-feed
Summary
GHSA-g9wg-wq4f-2x5w: Cross-Site Scripting in console-feed. Affects console-feed versions < 2.8.10. Fixed in 2.8.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
console-feed is an npm package that provides a console component for rendering logs in a web browser. It is commonly used in web applications to display console logs in a more user-friendly manner. However, versions prior to 2.8.10 are vulnerable to Cross-Site Scripting (XSS) attacks. This means that if an application uses console-feed and a malicious JavaScript payload is passed to a console.log('%_', payload) call, the package will render HTML containing the malicious payload.
Vulnerability Detail
The vulnerability in console-feed arises from a failure to properly escape the rendered output. This allows an attacker to inject malicious code into the HTML output, which can then be executed by unsuspecting users who view the logs. The impact of this vulnerability can range from stealing sensitive information, such as login credentials or session tokens, to performing actions on behalf of the user within the application.
How To Fix
Latest published version: 3.8.0 as of 22 Oct 2026
npm install console-feed@3.8.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.8.10
This is the first release that contains the fix.
npm install console-feed@2.8.10Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to manually sanitize any user-generated content that is passed to the console.log('%_', payload) call. This can be done using a library like DOMPurify to sanitize the payload before logging it.
Conclusion
In conclusion, the console-feed package prior to version 2.8.10 is vulnerable to Cross-Site Scripting (XSS) attacks. It is important to upgrade to the latest version or apply the recommended workaround to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for console-feed →
FAQ
console-feed is an npm package that provides a console component for rendering logs in a web browser. It is commonly used in web applications to display console logs in a more user-friendly manner.
Cross-Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to the theft of sensitive information or the execution of unauthorized actions within the application.
The console-feed vulnerability occurs due to a failure to properly escape the rendered output. This allows an attacker to inject malicious code into the HTML output, which can then be executed by unsuspecting users who view the logs.
The potential consequences of this vulnerability include the theft of sensitive information, such as login credentials or session tokens, as well as the ability to perform actions on behalf of the user within the application.
To fix the console-feed vulnerability, it is recommended to upgrade to version 2.8.10 or later of the package. This version includes the necessary fixes to properly escape the rendered output and prevent XSS attacks.
