CVE-2019-14862: XSS in knockout
Summary
CVE-2019-14862: XSS in knockout. Affects knockout versions < 3.5.0. Fixed in 3.5.0. How to fix ↓
Also tracked for
- node-knockout · Debian:11
The same CVE-2019-14862 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Knockout is an open-source JavaScript library that helps developers create dynamic user interfaces with a clean underlying data model. It allows for easy binding of HTML elements to data models, enabling automatic updates to the UI whenever the data changes. However, prior to version 3.5.0-beta, knockout is vulnerable to a cross-site scripting (XSS) attack. This vulnerability arises when the web application fails to properly validate user-supplied data before delivering it to users along with other trusted dynamic content.
Vulnerability Detail
The XSS vulnerability in knockout allows an attacker to inject malicious scripts into web pages viewed by users. This can lead to various security risks, such as stealing sensitive user information, performing actions on behalf of the user, or modifying the appearance and behavior of the web application. The vulnerability is rated as moderate severity (CVSS score: 6.1) and is classified under CWE-79 (Cross-Site Scripting).
How To Fix
Latest published version: 3.5.3 as of 23 Oct 2026
npm install knockout@3.5.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.5.0
This is the first release that contains the fix.
npm install knockout@3.5.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of knockout is not immediately feasible, a temporary workaround is to manually validate and sanitize user-supplied data before using it in the web application. This can be achieved by implementing proper input validation and output encoding techniques. Here's an example of how to sanitize user input in JavaScript:
function sanitizeInput(input) {
return input.replace(/</g, '<').replace(/>/g, '>');
}
Conclusion
In conclusion, the XSS vulnerability in knockout before version 3.5.0-beta can allow attackers to inject malicious scripts into web pages, posing various security risks. It is crucial to upgrade to the latest version of knockout or implement proper input validation and output encoding techniques to mitigate this vulnerability. For further support and assistance in vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for knockout →
FAQ
Knockout is a JavaScript library used for building dynamic user interfaces with a clean underlying data model. It simplifies the process of binding HTML elements to data models and automatically updating the UI when the data changes.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by users. These scripts can be used to steal sensitive information, perform actions on behalf of the user, or modify the appearance and behavior of the web application.
The XSS vulnerability in knockout can allow an attacker to execute arbitrary scripts in the context of the web application, potentially leading to the theft of sensitive user information, unauthorized actions, or manipulation of the application's appearance and behavior.
To mitigate this vulnerability, it is recommended to upgrade to version 3.5.0 or later of knockout. Additionally, developers should implement proper input validation and output encoding techniques to sanitize user-supplied data before using it in the application.
You can find more information about this vulnerability in the GitHub Security Advisory database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/04/GHSA-vcjj-xf2r-mwvc/GHSA-vcjj-xf2r-mwvc.json
References
Related vulnerabilities
Recent vulnerabilities recorded for knockout.
