CVE-2016-10744: Improper Neutralization of Input During Web Page Generation in Select2
Summary
CVE-2016-10744: Improper Neutralization of Input During Web Page Generation in Select2. Affects select2 versions < 4.0.6. Fixed in 4.0.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Select2 is an open-source JavaScript library that provides a customizable select box with support for searching, tagging, remote data sets, infinite scrolling, and many other features. It is commonly used in web applications to enhance the functionality and user experience of select lists. However, Select2 versions up to 4.0.5 are vulnerable to an XSS (Cross-Site Scripting) attack when used in conjunction with Ajax remote data loading and HTML templates to display listbox data. This vulnerability allows an attacker to inject malicious code into the web page, potentially leading to unauthorized access, data theft, or other malicious activities.
Vulnerability Detail
The vulnerability (CVE-2016-10744) in Select2 arises due to improper neutralization of input during web page generation. When using Select2 with Ajax remote data loading and HTML templates, the library fails to properly sanitize user input, allowing an attacker to inject malicious code into the generated web page. This can occur when the HTML templates used to display listbox data are not properly escaped or sanitized. As a result, an attacker can craft a specially crafted payload that, when executed by a victim user, will execute arbitrary JavaScript code in the context of the vulnerable web application. This can lead to various security issues, including session hijacking, data theft, defacement, or the execution of other malicious actions.
How To Fix
Latest published version: 4.1.0 as of 23 Oct 2026
npm install select2@4.1.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.0.6
This is the first release that contains the fix.
npm install select2@4.0.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of Select2 is not immediately feasible, developers can implement a workaround by manually sanitizing the user input before using it in HTML templates. This can be achieved by properly escaping any user-generated content and ensuring that it is treated as plain text rather than interpreted as HTML. For example, in JavaScript, developers can use the innerText property instead of innerHTML to set the content of an element, as innerText automatically escapes any HTML tags and treats the content as plain text.
Conclusion
In conclusion, the Select2 library versions up to 4.0.5 are vulnerable to an XSS attack when used with Ajax remote data loading and HTML templates. This can allow an attacker to inject malicious code into the web page and potentially compromise the security of the application. It is crucial for developers to upgrade to the latest version of Select2 (4.0.6 or later) or implement proper input sanitization to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for select2 →
FAQ
Select2 is an open-source JavaScript library that provides a customizable select box with advanced features such as searching, tagging, and remote data loading.
This vulnerability allows an attacker to inject malicious code into a web page, potentially leading to unauthorized access, data theft, or other malicious activities.
To fix this vulnerability, it is recommended to upgrade to Select2 version 4.0.6 or later.
If upgrading to the latest version is not immediately feasible, developers can manually sanitize user input before using it in HTML templates.
There are known exploits for this vulnerability, and it is important to patch affected systems as soon as possible to prevent potential attacks.
