Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

osm-static-maps

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.6npmAmendedPublished

    Injection and Cross-site Scripting in osm-static-maps

    CVE-2020-7749 · GHSA-pxcf-v868-m492

    Affected
    • npm osm-static-maps < 3.9.0
    Fixed in
    3.9.0· Vendor fix available
    Issue
    This affects all versions of package osm-static-maps under 3.9.0. User input given to the package is passed directly to a template without escaping ({{{ ... }}}). As such, it is possible for an attacker to inject arbitrary HTML/JS code and depending on the context. It will be outputted as an HTML on the page which gives opportunity for XSS or rendered on the server (puppeteer) which also gives opportunity for SSRF and Local File Read.

    Recommended action: Upgrade to 3.9.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →