Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

orejime

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Low, CVSS 0.6npmAmendedPublished

    Orejime has executable code in HTML attributes

    CVE-2025-68457 · GHSA-72mh-hgpm-6384

    Affected
    • npm orejime < 2.3.2
    Fixed in
    2.3.2· Vendor fix available
    Issue
    Impact On HTML elements handled by Orejime, one could run malicious code by embedding javascript: code within data attributes. When consenting to the related purpose, Orejime would turn data attributes into unprefixed ones (i.e. data-href into href), thus executing the code. This shouldn't have any impact on most setups, as elements handled by Orejime are generally hardcoded. The problem would only arise if somebody could inject HTML code within pages. See https://github.com/boscop-fr/orejime/issues/142 for the original report. Patches The problem has been patched by https://github.com/boscop-fr/orejime/pull/143. It is available in version 2.3.2. Workarounds The problem can be fixed outside of Orejime by sanitizing attributes which could contain executable code.

    Recommended action: Upgrade to 2.3.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →