Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A DOM Clobbering vulnerability has been discovered in layui that can lead to Cross-site Scripting (XSS) on web pages where attacker-controlled HTML elements (e.g., img tags with unsanitized name attributes) are present. It's worth noting that we’ve identifed similar issues in other popular client-side libraries like Webpack (CVE-2024-43788) and Vite (CVE-2024-45812), which might serve as valuable references. Backgrounds DOM Clobbering is a type of code-reuse attack where the attacker first embeds a piece of non-script, seemingly benign HTML markups in the webpage (e.g. through a post or comment) and leverages the gadgets (pieces of js code snippet) living in the existing libraries to transform it into executable code. Impact This vulnerability can lead to cross-site scripting (XSS) on websites that uses layui library and allow users to inject certain scriptless HTML tags with improperly sanitized name or id attributes. Patch This problem has been patched in Layui 2.9.17. You…
Recommended action: Upgrade to 2.9.17 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
layui up to v2.74 was discovered to contain a cross-site scripting (XSS) vulnerability via the data-content parameter.
Recommended action: Upgrade to 2.7.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A vulnerability, which was classified as problematic, was found in layui up to v2.8.0-rc.16. This affects an unknown part of the component HTML Attribute Handler. The manipulation of the argument title leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 2.8.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-234237 was assigned to this vulnerability.
Recommended action: Upgrade to 2.8.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.