Cross-Site Scripting in google-closure-library
Summary
GHSA-r9q4-w3fm-wrm2: Cross-Site Scripting in google-closure-library. Affects google-closure-library versions < 20190301.0.0. Fixed in 20190301.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The google-closure-library is an open-source JavaScript library developed by Google. It provides a set of reusable UI components and utilities for building web applications. The library is widely used and has a large user base. However, versions prior to 20190301.0.0 are vulnerable to Cross-Site Scripting (XSS) attacks.
Vulnerability Detail
The vulnerability in google-closure-library is due to the improper processing of empty elements in the safedomtreeprocessor.processToString() function. This flaw allows attackers to execute arbitrary JavaScript code through Mutation XSS. By exploiting this vulnerability, an attacker can inject malicious scripts into web pages, potentially leading to session hijacking, data theft, or defacement of the affected website.
How To Fix
Minimum fixed version
20190301.0.0
This is the first release that contains the fix.
npm install google-closure-library@20190301.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of the library to ensure the security of the application.
Conclusion
The google-closure-library prior to version 20190301.0.0 is vulnerable to Cross-Site Scripting (XSS) attacks. It is essential to upgrade to the fixed version to ensure the security of applications using this library. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for google-closure-library →
FAQ
Cross-Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to various attacks, such as session hijacking, data theft, or defacement of websites.
The safedomtreeprocessor.processToString() function in google-closure-library is responsible for processing DOM elements to generate a string representation. However, it improperly handles empty elements, which can be exploited by attackers to execute arbitrary JavaScript code.
Exploiting this vulnerability can allow attackers to execute arbitrary JavaScript code in the context of the affected user's browser. This can lead to various attacks, including stealing sensitive information, modifying web page content, or performing actions on behalf of the user.
No, only versions prior to 20190301.0.0 are affected by this vulnerability. It is recommended to upgrade to the fixed version to ensure the security of the application.
There are no known public exploits specifically targeting this vulnerability in google-closure-library. However, it is crucial to apply the recommended fix to mitigate the risk of potential attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for google-closure-library.
