Cross-Site Scripting Vulnerability in public Package
Summary
GHSA-7jfh-2xc9-ccv7: Cross-Site Scripting in public. Affects public versions < 0.1.4. Fixed in 0.1.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The public package is an npm module that is used for a specific functionality. It is vulnerable to a stored cross-site scripting (XSS) attack. This means that an attacker can inject malicious code into the application, which will be executed when other users view the affected page.
Vulnerability Detail
The vulnerability in the public package allows an attacker to perform a stored cross-site scripting attack. This can lead to various security risks, such as stealing sensitive user information, manipulating website content, or performing phishing attacks. The vulnerability is rated as low severity and has been assigned CWE-79.
How To Fix
Latest published version: 0.1.5 as of 22 Oct 2026
npm install public@0.1.5Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.1.4
This is the first release that contains the fix.
npm install public@0.1.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As there is no fix available, the best workaround is to find an alternative package that provides similar functionality and is not vulnerable to cross-site scripting attacks. It is important to thoroughly review the security of any alternative package before using it in your application.
Conclusion
The public package is vulnerable to a stored cross-site scripting attack. Currently, there is no fix available, and it is recommended to avoid using this package. Consider finding alternative packages that provide similar functionality and have better security measures in place. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for public →
FAQ
A stored XSS attack is a type of cross-site scripting attack where the malicious code is permanently stored on the target server, and every user who accesses the affected page is exposed to the attack.
The risks of this vulnerability include unauthorized access to user information, manipulation of website content, and the possibility of performing phishing attacks to deceive users.
No, there is currently no fix available for this vulnerability. It is recommended to avoid using the public package until a fix is released.
It is recommended to search for alternative packages that provide similar functionality and are not vulnerable to cross-site scripting attacks. Thoroughly review the security of any alternative package before using it in your application.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for public.
