CVE-2018-16481: Cross-Site Scripting in html-pages
Summary
CVE-2018-16481: Cross-Site Scripting in html-pages. Affects html-pages versions < 3.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The html-pages package is an npm package used for generating HTML pages. It allows users to create static HTML pages with ease. However, all versions of html-pages are vulnerable to Cross-Site Scripting (XSS) attacks. This vulnerability arises from the package's failure to properly sanitize folder names, which enables attackers to execute arbitrary JavaScript in the victim's browser through folders with malicious code.
Vulnerability Detail
The Cross-Site Scripting vulnerability in html-pages allows attackers to inject and execute arbitrary JavaScript code in the victim's browser. By creating folders with names containing malicious code, an attacker can trick users into accessing these folders, leading to the execution of the injected code. This can result in various security risks, including the theft of sensitive information, session hijacking, and unauthorized actions on behalf of the victim.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no fix available, a possible workaround is to manually sanitize folder names before using the html-pages package. This can be done by implementing a function that removes or escapes any potentially malicious characters from folder names. Here's an example in JavaScript:
function sanitizeFolderName(folderName) {
// Implement your sanitization logic here
// Return the sanitized folder name
}
Conclusion
The html-pages package is vulnerable to Cross-Site Scripting (XSS) attacks due to its failure to properly sanitize folder names. This can lead to the execution of arbitrary JavaScript code in the victim's browser, posing various security risks. Currently, there is no fix available for this vulnerability, so it is recommended to consider using an alternative package. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for html-pages →
FAQ
Cross-Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. These scripts can be used to steal sensitive information, manipulate web content, or perform unauthorized actions on behalf of the victim.
The vulnerability in html-pages arises from its failure to properly sanitize folder names. Attackers can create folders with names containing malicious JavaScript code. When a user accesses a page that includes a link to one of these folders, the injected code is executed in the user's browser, potentially leading to various security risks.
Yes, all versions of html-pages up to and including version 3.1.0 are vulnerable to this Cross-Site Scripting issue.
No, currently there is no fix available for this vulnerability in the html-pages package. It is recommended to consider using an alternative package until a fix is made available.
You can find more information about this vulnerability in the html-pages package in the GitHub Advisory Database. Visit the following link: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/02/GHSA-5p26-hw7f-3cpr/GHSA-5p26-hw7f-3cpr.json
Related vulnerabilities
Recent vulnerabilities recorded for html-pages.
